Analysis Overview
SHA256
30e61dc438109787a0803b2498fbe6d8c978bdfe723583afb3504ce6dccbcec0
Threat Level: Known bad
The file NEAS.30e61dc438109787a0803b2498fbe6d8c978bdfe723583afb3504ce6dccbcec0.exe was found to be: Known bad.
Malicious Activity Summary
Mystic
RedLine payload
SectopRAT payload
RedLine
Detect ZGRat V1
Glupteba
Detect Mystic stealer payload
Glupteba payload
SmokeLoader
SectopRAT
ZGRat
Modifies Windows Firewall
Downloads MZ/PE file
Stops running service(s)
Executes dropped EXE
Checks computer location settings
Reads user/profile data of web browsers
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
Launches sc.exe
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Checks SCSI registry key(s)
Suspicious behavior: MapViewOfSection
Uses Task Scheduler COM API
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-11-11 10:54
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-11-11 10:54
Reported
2023-11-11 10:56
Platform
win10v2004-20231023-en
Max time kernel
71s
Max time network
157s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Mystic
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
ZGRat
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Xv4eL01.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\8C2.exe | N/A |
Executes dropped EXE
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\NEAS.30e61dc438109787a0803b2498fbe6d8c978bdfe723583afb3504ce6dccbcec0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vX5bo88.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dX8GD76.exe | N/A |
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3780 set thread context of 1972 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ra57sz9.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 840 set thread context of 3696 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6TU5lO9.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4880 set thread context of 2664 | N/A | C:\Users\Admin\AppData\Local\Temp\B44.exe | C:\Users\Admin\AppData\Local\Temp\B44.exe |
| PID 3848 set thread context of 1888 | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\E655.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\E579.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\B44.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\D1A.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Broom.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\NEAS.30e61dc438109787a0803b2498fbe6d8c978bdfe723583afb3504ce6dccbcec0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.30e61dc438109787a0803b2498fbe6d8c978bdfe723583afb3504ce6dccbcec0.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vX5bo88.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vX5bo88.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dX8GD76.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dX8GD76.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ra57sz9.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ra57sz9.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1972 -ip 1972
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6TU5lO9.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6TU5lO9.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Xv4eL01.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Xv4eL01.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
C:\Users\Admin\AppData\Local\Temp\E579.exe
C:\Users\Admin\AppData\Local\Temp\E579.exe
C:\Users\Admin\AppData\Local\Temp\E655.exe
C:\Users\Admin\AppData\Local\Temp\E655.exe
C:\Users\Admin\AppData\Local\Temp\8C2.exe
C:\Users\Admin\AppData\Local\Temp\8C2.exe
C:\Users\Admin\AppData\Local\Temp\B44.exe
C:\Users\Admin\AppData\Local\Temp\B44.exe
C:\Users\Admin\AppData\Local\Temp\D1A.exe
C:\Users\Admin\AppData\Local\Temp\D1A.exe
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\B44.exe
C:\Users\Admin\AppData\Local\Temp\B44.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Roaming\Tags\Settings.exe
C:\Users\Admin\AppData\Roaming\Tags\Settings.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Users\Admin\AppData\Local\Temp\BEB7.exe
C:\Users\Admin\AppData\Local\Temp\BEB7.exe
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Users\Admin\AppData\Local\Temp\2BAB.exe
C:\Users\Admin\AppData\Local\Temp\2BAB.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Users\Admin\AppData\Local\Temp\716F.exe
C:\Users\Admin\AppData\Local\Temp\716F.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| US | 194.49.94.72:80 | tcp | |
| US | 8.8.8.8:53 | 190.92.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.252.72.23.in-addr.arpa | udp |
| RU | 5.42.92.51:19057 | tcp | |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| NL | 194.169.175.118:80 | 194.169.175.118 | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.175.169.194.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| US | 194.49.94.11:80 | tcp | |
| MD | 176.123.9.142:37637 | tcp | |
| US | 8.8.8.8:53 | 142.9.123.176.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| IT | 185.196.9.161:80 | 185.196.9.161 | tcp |
| US | 8.8.8.8:53 | 161.9.196.185.in-addr.arpa | udp |
| RU | 185.174.136.219:443 | tcp | |
| RU | 5.42.92.51:19057 | tcp | |
| US | 194.49.94.11:80 | tcp | |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| RU | 5.42.64.16:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 194.49.94.11:80 | tcp | |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| RU | 5.42.64.16:443 | tcp | |
| US | 8.8.8.8:53 | bluepablo.fun | udp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | 41.18.21.104.in-addr.arpa | udp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| US | 95.214.26.28:80 | host-host-file8.com | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | 28.26.214.95.in-addr.arpa | udp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 194.49.94.11:80 | tcp | |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| RU | 5.42.64.16:443 | tcp | |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | e5c07123-f6ed-4756-8038-5e88f55ea08a.uuid.theupdatetime.org | udp |
| US | 8.8.8.8:53 | 6.173.189.20.in-addr.arpa | udp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| RU | 5.42.92.51:19057 | tcp | |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| RU | 5.42.92.190:80 | 5.42.92.190 | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 104.21.18.41:80 | bluepablo.fun | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | stun3.l.google.com | udp |
| US | 8.8.8.8:53 | server16.theupdatetime.org | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vX5bo88.exe
| MD5 | 23993b93bf5ebf8ef64f70826290464b |
| SHA1 | cce54c4bb949b9f563c4214d84b30662b1a067ff |
| SHA256 | 72b34c3df3ed42ef1c227059be9abecbbcecc309adda664c0183af127d0fc731 |
| SHA512 | 26f2b0d07ae76b5b9721691d4f817154e907f8d3978a3bb3de3e9de92c69fe860a4e20c8147a00f1c21949f3a4d2dffb6f25c3fab16940968ea5931e070cf55e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vX5bo88.exe
| MD5 | 23993b93bf5ebf8ef64f70826290464b |
| SHA1 | cce54c4bb949b9f563c4214d84b30662b1a067ff |
| SHA256 | 72b34c3df3ed42ef1c227059be9abecbbcecc309adda664c0183af127d0fc731 |
| SHA512 | 26f2b0d07ae76b5b9721691d4f817154e907f8d3978a3bb3de3e9de92c69fe860a4e20c8147a00f1c21949f3a4d2dffb6f25c3fab16940968ea5931e070cf55e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dX8GD76.exe
| MD5 | 5ceba9c793cd982b8e3e21256e505f3e |
| SHA1 | cf187dd86b3341a435601706501194298ddc2f39 |
| SHA256 | cdc44a5883f7f6e5a7a2a34a3c227e2f5e61afe84b31d8b394ca6a77b570754c |
| SHA512 | 36f49e67d621fe66b417b03bb671d13f516624e14917f5f53e4c83562a04590ef064c61046fc01671e3346db97d573487498bfa8a7e6354bca008c6830d961af |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dX8GD76.exe
| MD5 | 5ceba9c793cd982b8e3e21256e505f3e |
| SHA1 | cf187dd86b3341a435601706501194298ddc2f39 |
| SHA256 | cdc44a5883f7f6e5a7a2a34a3c227e2f5e61afe84b31d8b394ca6a77b570754c |
| SHA512 | 36f49e67d621fe66b417b03bb671d13f516624e14917f5f53e4c83562a04590ef064c61046fc01671e3346db97d573487498bfa8a7e6354bca008c6830d961af |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ra57sz9.exe
| MD5 | 784667bb96ccb30c4cf44f2c5f493769 |
| SHA1 | 28185165ab4dbbb4a139ae1af0bb6934ebe05c04 |
| SHA256 | 1025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9 |
| SHA512 | 62c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ra57sz9.exe
| MD5 | 784667bb96ccb30c4cf44f2c5f493769 |
| SHA1 | 28185165ab4dbbb4a139ae1af0bb6934ebe05c04 |
| SHA256 | 1025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9 |
| SHA512 | 62c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20 |
memory/1972-21-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1972-22-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1972-23-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1972-25-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe
| MD5 | b938034561ab089d7047093d46deea8f |
| SHA1 | d778c32cc46be09b107fa47cf3505ba5b748853d |
| SHA256 | 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161 |
| SHA512 | 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b |
memory/4696-29-0x0000000000400000-0x000000000040B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sR7618.exe
| MD5 | b938034561ab089d7047093d46deea8f |
| SHA1 | d778c32cc46be09b107fa47cf3505ba5b748853d |
| SHA256 | 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161 |
| SHA512 | 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b |
memory/3300-30-0x0000000003350000-0x0000000003366000-memory.dmp
memory/4696-31-0x0000000000400000-0x000000000040B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6TU5lO9.exe
| MD5 | 14d9834611ad581afcfea061652ff6cb |
| SHA1 | 802f964d0be7858eb2f1e7c6fcda03501fd1b71c |
| SHA256 | e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60 |
| SHA512 | cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6TU5lO9.exe
| MD5 | 14d9834611ad581afcfea061652ff6cb |
| SHA1 | 802f964d0be7858eb2f1e7c6fcda03501fd1b71c |
| SHA256 | e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60 |
| SHA512 | cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5 |
memory/3696-37-0x0000000000400000-0x000000000043C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Xv4eL01.exe
| MD5 | 20067f022d5e1e73fbc932cadc3c394f |
| SHA1 | 1c8b2e9827820662fd8e0d2175a3634ea2cee17c |
| SHA256 | ee800fbbb26e31086b0e1b18d0b89d9aba1dd08089acd6beae5fe77c94ee57fa |
| SHA512 | 45e89b28b9beb2f81f88babfdb75173d74d9060d10a93334a30a17333d0fdecf2e8557d883f7e3678a16b980fcaf53e5928617426036c3751bbc217a8894d285 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Xv4eL01.exe
| MD5 | 20067f022d5e1e73fbc932cadc3c394f |
| SHA1 | 1c8b2e9827820662fd8e0d2175a3634ea2cee17c |
| SHA256 | ee800fbbb26e31086b0e1b18d0b89d9aba1dd08089acd6beae5fe77c94ee57fa |
| SHA512 | 45e89b28b9beb2f81f88babfdb75173d74d9060d10a93334a30a17333d0fdecf2e8557d883f7e3678a16b980fcaf53e5928617426036c3751bbc217a8894d285 |
memory/3696-43-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/3696-45-0x00000000078D0000-0x0000000007E74000-memory.dmp
memory/3696-47-0x00000000073C0000-0x0000000007452000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is64.bat
| MD5 | 225edee1d46e0a80610db26b275d72fb |
| SHA1 | ce206abf11aaf19278b72f5021cc64b1b427b7e8 |
| SHA256 | e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559 |
| SHA512 | 4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504 |
C:\Users\Admin\AppData\Local\Temp\is64.txt
| MD5 | a5ea0ad9260b1550a14cc58d2c39b03d |
| SHA1 | f0aedf295071ed34ab8c6a7692223d22b6a19841 |
| SHA256 | f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04 |
| SHA512 | 7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74 |
memory/3696-52-0x0000000007370000-0x0000000007380000-memory.dmp
memory/3696-54-0x0000000007360000-0x000000000736A000-memory.dmp
memory/3696-55-0x00000000084A0000-0x0000000008AB8000-memory.dmp
memory/3696-56-0x00000000076C0000-0x00000000077CA000-memory.dmp
memory/3696-57-0x00000000075E0000-0x00000000075F2000-memory.dmp
memory/3696-58-0x0000000007640000-0x000000000767C000-memory.dmp
memory/3696-59-0x00000000077D0000-0x000000000781C000-memory.dmp
memory/3696-60-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/3696-61-0x0000000007370000-0x0000000007380000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E579.exe
| MD5 | f6079a0d6e9c3d6c80af8adb5033b007 |
| SHA1 | c111e23c945fc86bf81729112ba1c0acdab479a0 |
| SHA256 | fed9fe7c0027acbfeb05ae652b70d981ed3aabb54559eb6bfb1ba24a27e1c3a7 |
| SHA512 | 02f4609bad9babbd141e2e80e923a99b6e03969fbbf53ad1f99f1839da83076c41dd8765df081587bba466437ff64f292c672616addcae524e1e4909bc7c44bf |
C:\Users\Admin\AppData\Local\Temp\E579.exe
| MD5 | f6079a0d6e9c3d6c80af8adb5033b007 |
| SHA1 | c111e23c945fc86bf81729112ba1c0acdab479a0 |
| SHA256 | fed9fe7c0027acbfeb05ae652b70d981ed3aabb54559eb6bfb1ba24a27e1c3a7 |
| SHA512 | 02f4609bad9babbd141e2e80e923a99b6e03969fbbf53ad1f99f1839da83076c41dd8765df081587bba466437ff64f292c672616addcae524e1e4909bc7c44bf |
C:\Users\Admin\AppData\Local\Temp\E655.exe
| MD5 | 0592c6d7674c77b053080c5b6e79fdcb |
| SHA1 | 693339ede19093e2b4593fda93be0b140be69141 |
| SHA256 | fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14 |
| SHA512 | 37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb |
C:\Users\Admin\AppData\Local\Temp\E655.exe
| MD5 | 0592c6d7674c77b053080c5b6e79fdcb |
| SHA1 | 693339ede19093e2b4593fda93be0b140be69141 |
| SHA256 | fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14 |
| SHA512 | 37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb |
memory/4108-70-0x0000000000930000-0x000000000094E000-memory.dmp
memory/4108-71-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/4184-73-0x0000000000400000-0x000000000046F000-memory.dmp
memory/4184-72-0x00000000006A0000-0x00000000006FA000-memory.dmp
memory/4108-75-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/4184-78-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/4184-79-0x0000000007630000-0x0000000007640000-memory.dmp
memory/4184-80-0x0000000008100000-0x0000000008166000-memory.dmp
memory/4184-81-0x00000000089F0000-0x0000000008A66000-memory.dmp
memory/4184-82-0x0000000008AC0000-0x0000000008ADE000-memory.dmp
memory/4184-83-0x0000000008C80000-0x0000000008E42000-memory.dmp
memory/4184-84-0x0000000008E50000-0x000000000937C000-memory.dmp
memory/4184-85-0x0000000009630000-0x0000000009680000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\8C2.exe
| MD5 | c6efb8a96d16975e226f757619892d09 |
| SHA1 | fe1d7fc49e6ca211930347334eb27b0d64d9b5dc |
| SHA256 | 2f831895016ec2f255ca65fb3fb7b7aac1c5f8bd07569fd170bba8dabca86f7c |
| SHA512 | d373614d6d4fb31449212936d62f4584b8023a9c4776e7fc94634b0c494137287f7bf9b2296a4f8e1b43055fd73377322a4bae01407ea95615723f7a2e4cd8ec |
C:\Users\Admin\AppData\Local\Temp\8C2.exe
| MD5 | c6efb8a96d16975e226f757619892d09 |
| SHA1 | fe1d7fc49e6ca211930347334eb27b0d64d9b5dc |
| SHA256 | 2f831895016ec2f255ca65fb3fb7b7aac1c5f8bd07569fd170bba8dabca86f7c |
| SHA512 | d373614d6d4fb31449212936d62f4584b8023a9c4776e7fc94634b0c494137287f7bf9b2296a4f8e1b43055fd73377322a4bae01407ea95615723f7a2e4cd8ec |
memory/1880-92-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1880-93-0x0000000000480000-0x000000000111A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B44.exe
| MD5 | d497d6f5d3b74379d1ca2e1abde20281 |
| SHA1 | 937aac5cf9191e833724edda2742ed115a5237c7 |
| SHA256 | a1765648a41eea21fd942776cba9b50705673d8f7564ae7f8c9751eda9e2e564 |
| SHA512 | bdb28622542e3b34e40b37a189a967b6136963200fec616c6147fd36bb543b94a7d64128d5fbd65a5358b1131dc265c7cbdb1240fece3e8c09652b97c4c025a6 |
memory/4880-99-0x0000020544B50000-0x0000020544C3E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B44.exe
| MD5 | d497d6f5d3b74379d1ca2e1abde20281 |
| SHA1 | 937aac5cf9191e833724edda2742ed115a5237c7 |
| SHA256 | a1765648a41eea21fd942776cba9b50705673d8f7564ae7f8c9751eda9e2e564 |
| SHA512 | bdb28622542e3b34e40b37a189a967b6136963200fec616c6147fd36bb543b94a7d64128d5fbd65a5358b1131dc265c7cbdb1240fece3e8c09652b97c4c025a6 |
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | bc3354a4cd405a2f2f98e8b343a7d08d |
| SHA1 | 4880d2a987354a3163461fddd2422e905976c5b2 |
| SHA256 | fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b |
| SHA512 | fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b |
C:\Users\Admin\AppData\Local\Temp\D1A.exe
| MD5 | 73ae6c3b85c619aa3fb06de545597251 |
| SHA1 | eb1aebe3b76ca3a2b5075880a307c7da2a7d4526 |
| SHA256 | 622b9f4f5d1eb80a8d6c0384d4c2cc62db85499005cbc5efb35e0fd343db7427 |
| SHA512 | 912a6aac98a5e83d9519b9bb40efebe843d5265768a702c5523161ba2edd422d7c7d743eaac8c5ddab6719f2500a9826979baab2ed22d0bd7d6be66f56d59923 |
memory/3960-109-0x0000025BB77B0000-0x0000025BB7852000-memory.dmp
memory/4880-110-0x000002055F1E0000-0x000002055F2C0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | bc3354a4cd405a2f2f98e8b343a7d08d |
| SHA1 | 4880d2a987354a3163461fddd2422e905976c5b2 |
| SHA256 | fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b |
| SHA512 | fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b |
memory/4880-112-0x00007FF8B3020000-0x00007FF8B3AE1000-memory.dmp
memory/4880-116-0x000002055F2C0000-0x000002055F388000-memory.dmp
memory/3960-114-0x0000025BD1D00000-0x0000025BD1E00000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | dcbd05276d11111f2dd2a7edf52e3386 |
| SHA1 | f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec |
| SHA256 | cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4 |
| SHA512 | 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846 |
memory/4880-126-0x0000020546830000-0x0000020546840000-memory.dmp
memory/4880-127-0x000002055F490000-0x000002055F558000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | dcbd05276d11111f2dd2a7edf52e3386 |
| SHA1 | f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec |
| SHA256 | cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4 |
| SHA512 | 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846 |
memory/4880-133-0x000002055F560000-0x000002055F5AC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | bc3354a4cd405a2f2f98e8b343a7d08d |
| SHA1 | 4880d2a987354a3163461fddd2422e905976c5b2 |
| SHA256 | fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b |
| SHA512 | fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | dcbd05276d11111f2dd2a7edf52e3386 |
| SHA1 | f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec |
| SHA256 | cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4 |
| SHA512 | 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846 |
memory/3960-146-0x0000025BB95B0000-0x0000025BB9606000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/2664-154-0x0000000000400000-0x00000000004AA000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\B44.exe.log
| MD5 | 9f5d0107d96d176b1ffcd5c7e7a42dc9 |
| SHA1 | de83788e2f18629555c42a3e6fada12f70457141 |
| SHA256 | d0630b8466cebaaf92533826f6547b6f36a3c480848dc38d650acd52b522a097 |
| SHA512 | 86cfaa3327b59a976ddd4a5915f3fe8c938481344fcbd10e7533b4c5003673d078756e62435940471658a03504c3bc30603204d6a133727a3f36c96d08714c61 |
C:\Users\Admin\AppData\Local\Temp\B44.exe
| MD5 | d497d6f5d3b74379d1ca2e1abde20281 |
| SHA1 | 937aac5cf9191e833724edda2742ed115a5237c7 |
| SHA256 | a1765648a41eea21fd942776cba9b50705673d8f7564ae7f8c9751eda9e2e564 |
| SHA512 | bdb28622542e3b34e40b37a189a967b6136963200fec616c6147fd36bb543b94a7d64128d5fbd65a5358b1131dc265c7cbdb1240fece3e8c09652b97c4c025a6 |
memory/2664-159-0x0000022EBE8F0000-0x0000022EBE9D4000-memory.dmp
memory/4880-163-0x00007FF8B3020000-0x00007FF8B3AE1000-memory.dmp
memory/1880-162-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/2664-164-0x00007FF8B3020000-0x00007FF8B3AE1000-memory.dmp
memory/2664-166-0x0000022ED72F0000-0x0000022ED7300000-memory.dmp
memory/2664-165-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-167-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/4108-168-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/2664-171-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/1636-170-0x0000000002930000-0x0000000002931000-memory.dmp
memory/2664-173-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-175-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/3960-161-0x0000025BD1E50000-0x0000025BD1EA4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/2664-177-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
memory/2664-179-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Broom.exe
| MD5 | 00e93456aa5bcf9f60f84b0c0760a212 |
| SHA1 | 6096890893116e75bd46fea0b8c3921ceb33f57d |
| SHA256 | ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504 |
| SHA512 | abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca |
memory/2664-181-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
memory/2664-183-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/3960-125-0x0000025BB7C30000-0x0000025BB7C40000-memory.dmp
memory/2664-185-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/3960-117-0x00007FF8B3020000-0x00007FF8B3AE1000-memory.dmp
memory/2664-187-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/4880-108-0x00000205468A0000-0x0000020546980000-memory.dmp
memory/2664-189-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-191-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D1A.exe
| MD5 | 73ae6c3b85c619aa3fb06de545597251 |
| SHA1 | eb1aebe3b76ca3a2b5075880a307c7da2a7d4526 |
| SHA256 | 622b9f4f5d1eb80a8d6c0384d4c2cc62db85499005cbc5efb35e0fd343db7427 |
| SHA512 | 912a6aac98a5e83d9519b9bb40efebe843d5265768a702c5523161ba2edd422d7c7d743eaac8c5ddab6719f2500a9826979baab2ed22d0bd7d6be66f56d59923 |
memory/2664-193-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-195-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-197-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-199-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-202-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-204-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-206-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-208-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-211-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-213-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-215-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/2664-217-0x0000022EBE8F0000-0x0000022EBE9D1000-memory.dmp
memory/4108-231-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/3848-234-0x0000000000A10000-0x0000000000B10000-memory.dmp
memory/1888-239-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | dcbd05276d11111f2dd2a7edf52e3386 |
| SHA1 | f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec |
| SHA256 | cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4 |
| SHA512 | 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846 |
memory/3848-236-0x0000000000810000-0x0000000000819000-memory.dmp
memory/4184-242-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1576-260-0x0000000002960000-0x0000000002D5B000-memory.dmp
memory/1576-264-0x0000000002D60000-0x000000000364B000-memory.dmp
memory/1576-269-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1888-618-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3960-775-0x00007FF8B3020000-0x00007FF8B3AE1000-memory.dmp
memory/1400-830-0x0000000004CD0000-0x0000000004D06000-memory.dmp
memory/1400-833-0x0000000074310000-0x0000000074AC0000-memory.dmp
memory/1400-835-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/1400-837-0x0000000005420000-0x0000000005A48000-memory.dmp
memory/1400-839-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdrgoowm.4be.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
C:\Users\Admin\AppData\Roaming\Tags\Settings.exe
| MD5 | 73ae6c3b85c619aa3fb06de545597251 |
| SHA1 | eb1aebe3b76ca3a2b5075880a307c7da2a7d4526 |
| SHA256 | 622b9f4f5d1eb80a8d6c0384d4c2cc62db85499005cbc5efb35e0fd343db7427 |
| SHA512 | 912a6aac98a5e83d9519b9bb40efebe843d5265768a702c5523161ba2edd422d7c7d743eaac8c5ddab6719f2500a9826979baab2ed22d0bd7d6be66f56d59923 |
C:\Users\Admin\AppData\Roaming\Tags\Settings.exe
| MD5 | 73ae6c3b85c619aa3fb06de545597251 |
| SHA1 | eb1aebe3b76ca3a2b5075880a307c7da2a7d4526 |
| SHA256 | 622b9f4f5d1eb80a8d6c0384d4c2cc62db85499005cbc5efb35e0fd343db7427 |
| SHA512 | 912a6aac98a5e83d9519b9bb40efebe843d5265768a702c5523161ba2edd422d7c7d743eaac8c5ddab6719f2500a9826979baab2ed22d0bd7d6be66f56d59923 |
C:\Users\Admin\AppData\Local\Temp\BEB7.exe
| MD5 | 4bb2473f19d24fbd573a45050f59ea62 |
| SHA1 | 32cc57c1f1f0716e810b9dfdf101dddc02faeb0b |
| SHA256 | 064c16bb2715e8f8713605c4ffc75962302cf0c8a7b06dbac92b40a05f1dd3bf |
| SHA512 | d82387755e966880251965328e7e8281bba4517b4cb6ff0959c972853bb8bb59d6513d48755d56f091b611ed3c4ef101a6e04696606f2267646300e73de0c5b3 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | e4ba016af1891c3d81a2a7b74fd79525 |
| SHA1 | c33fc43e7ecdb47564ccc876b28b5de753816a91 |
| SHA256 | 071d24eb67c9545b551c422310ee569af2b1881edf3e0dcc5d889cf21a8f054e |
| SHA512 | 09a6fed9e2867eed146e84e66addf0acac4e05b7a12838579253a9b0fd2a72e8f4465fa0ed41f60b006df6d98a261f079067f2a54b4654766f123304ecc93124 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | bd5940f08d0be56e65e5f2aaf47c538e |
| SHA1 | d7e31b87866e5e383ab5499da64aba50f03e8443 |
| SHA256 | 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6 |
| SHA512 | c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406 |
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 824a568bb411f045f64b3a056e024601 |
| SHA1 | c38eea0be9168ebcf3c8061719e2a460eb5f1cde |
| SHA256 | 176a24a8400fb7a9f379cd06361867b24a63dacbee802f913607f28b6dbe276d |
| SHA512 | 174518bef47b93e5d7a0cc94688e6c5a41b5e651e63058290a67cbd06b941cc6488b01ed49aa57017575c22ce1e2f04c0b9e98eb4899d6dd31a6d66453813ad1 |
C:\Program Files\Google\Chrome\updater.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
C:\Windows\rss\csrss.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
C:\Windows\rss\csrss.exe
| MD5 | c067b4583e122ce237ff22e9c2462f87 |
| SHA1 | 8a4545391b205291f0c0ee90c504dc458732f4ed |
| SHA256 | a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e |
| SHA512 | 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3 |
C:\Users\Admin\AppData\Local\Temp\2BAB.exe
| MD5 | 4bb2473f19d24fbd573a45050f59ea62 |
| SHA1 | 32cc57c1f1f0716e810b9dfdf101dddc02faeb0b |
| SHA256 | 064c16bb2715e8f8713605c4ffc75962302cf0c8a7b06dbac92b40a05f1dd3bf |
| SHA512 | d82387755e966880251965328e7e8281bba4517b4cb6ff0959c972853bb8bb59d6513d48755d56f091b611ed3c4ef101a6e04696606f2267646300e73de0c5b3 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | bbc2d436842ef94c73b47281684c8897 |
| SHA1 | 56cc3d19ccb1bc4db52b62829574b5ab52fd3a37 |
| SHA256 | d1fa946708bc376429d73a09f5f1095d753d60a6d4577adc0c837e85492a086c |
| SHA512 | 7479a8a04a7d2a7be69690298fc0c4eff62050f706be9352cc23b7c69c846a85ae96db6cc4a52e68f1dc95195c7074ff2b9a1997e74382a7d34df8119f696f03 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | e26c2a35724ee0578c7fbfba09f9a327 |
| SHA1 | 8140d5af4379a53dff5cbfaf762ae0325b84fd67 |
| SHA256 | dbb9ce6f31d36d3f4fdf50824d2bdd95920c7af3be8d93da1124dce11f2adadd |
| SHA512 | deb9e0864236303cb77bc4d7056649d9887222f4e9ba00a9d7e91ca98df9424a09e1ed6f7f8fbf76e004866795e2c6c2c4e32ad267e5eb23cb56848ca7db7255 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 1aae2c6d187a0665779b87326a34058f |
| SHA1 | cb4e490043801752ae0b56d6bf579b02b278b259 |
| SHA256 | fc922d07149dec4fc6096a4dbbbc56a6e408e74ad50315b498ba9e115b9ab419 |
| SHA512 | c771cd46faa3d52358f9570b69953c01edb99664a913a7bd91c6b0c163a5ee6e843e1769ff48fcde4f5bbb7b9206ad0e1d970ca1c06d66d14821e523af53f369 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b11ad894798d5b1e433c0944912a6830 |
| SHA1 | 445f78ac1bbf88b8552e7a24143466998c437d1c |
| SHA256 | f044666e487c92cd3a1582c872c9a38694b485d748342b288bbabeb88d7f07a9 |
| SHA512 | 3be9e2fd47fe3a028f55420723929dce60c6005265086e62a1dbb7591a5f3401e214979856fd9259678bcfc3997cc1db43b64e12fd106e6c09cbaa86200cedf2 |
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
| MD5 | d98e33b66343e7c96158444127a117f6 |
| SHA1 | bb716c5509a2bf345c6c1152f6e3e1452d39d50d |
| SHA256 | 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1 |
| SHA512 | 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5 |
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
| MD5 | d98e33b66343e7c96158444127a117f6 |
| SHA1 | bb716c5509a2bf345c6c1152f6e3e1452d39d50d |
| SHA256 | 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1 |
| SHA512 | 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5 |
C:\Users\Admin\AppData\Local\Temp\716F.exe
| MD5 | 5e2d2087340d2d4e4faa3e945c932a95 |
| SHA1 | da8b6a28923983fe9b1e0b18f0b540df24382851 |
| SHA256 | 63ee50294b30ab0e0569baea7a8b52454ba95264fdce6709d3437a462be9d888 |
| SHA512 | 47e45183467aff329e74f347b83f90a62f1ef5168368c46379c0d0b7defcce1192e5e13dd7fece5b39050386de11152a5001fb3fc7bb8ebdea576008bc90b3d0 |