Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 08:28
Static task
static1
General
-
Target
dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe
-
Size
4.2MB
-
MD5
3a9c8143ac63b230dc602a2c2f9372de
-
SHA1
e8f01d5e448bbc46df3708c586c46da8bb4bf7d4
-
SHA256
dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500
-
SHA512
b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8
-
SSDEEP
98304:jL+xkLfOKMBaabC2T6lDT99f560XhMLgDeYJUygu:HMkLaBfbp8XfbXWaJgu
Malware Config
Signatures
-
Glupteba payload 20 IoCs
resource yara_rule behavioral1/memory/488-2-0x0000000002E00000-0x00000000036EB000-memory.dmp family_glupteba behavioral1/memory/488-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/488-5-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/488-28-0x0000000002E00000-0x00000000036EB000-memory.dmp family_glupteba behavioral1/memory/488-29-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/488-49-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/488-62-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4748-64-0x0000000002A50000-0x0000000002E4A000-memory.dmp family_glupteba behavioral1/memory/4748-65-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4748-99-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4748-116-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4748-159-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4748-164-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-185-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-215-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-267-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-325-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-357-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-371-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/916-383-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4448 netsh.exe -
Executes dropped EXE 5 IoCs
pid Process 916 csrss.exe 2232 injector.exe 4704 windefender.exe 60 tor.exe 2404 windefender.exe -
Loads dropped DLL 10 IoCs
pid Process 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe 60 tor.exe -
resource yara_rule behavioral1/files/0x0006000000022faa-270.dat upx behavioral1/files/0x0006000000022faa-272.dat upx behavioral1/files/0x0006000000022faa-320.dat upx behavioral1/memory/4704-322-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2404-352-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2404-381-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe File created C:\Windows\rss\csrss.exe dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2240 sc.exe 4892 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4540 schtasks.exe 2936 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 powershell.exe 2248 powershell.exe 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 1772 powershell.exe 1772 powershell.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 3496 powershell.exe 3496 powershell.exe 3496 powershell.exe 2008 powershell.exe 2008 powershell.exe 2008 powershell.exe 4108 powershell.exe 4108 powershell.exe 4108 powershell.exe 4180 powershell.exe 4180 powershell.exe 4180 powershell.exe 4108 powershell.exe 4108 powershell.exe 4108 powershell.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 916 csrss.exe 916 csrss.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 916 csrss.exe 916 csrss.exe 2232 injector.exe 2232 injector.exe 916 csrss.exe 916 csrss.exe 2232 injector.exe 2232 injector.exe 916 csrss.exe 916 csrss.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe 2232 injector.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Token: SeImpersonatePrivilege 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeSystemEnvironmentPrivilege 916 csrss.exe Token: SeSecurityPrivilege 2240 sc.exe Token: SeSecurityPrivilege 2240 sc.exe Token: SeSecurityPrivilege 4892 sc.exe Token: SeSecurityPrivilege 4892 sc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 488 wrote to memory of 2248 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 89 PID 488 wrote to memory of 2248 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 89 PID 488 wrote to memory of 2248 488 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 89 PID 4748 wrote to memory of 1772 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 103 PID 4748 wrote to memory of 1772 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 103 PID 4748 wrote to memory of 1772 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 103 PID 4748 wrote to memory of 2776 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 108 PID 4748 wrote to memory of 2776 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 108 PID 2776 wrote to memory of 4448 2776 cmd.exe 110 PID 2776 wrote to memory of 4448 2776 cmd.exe 110 PID 4748 wrote to memory of 3496 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 111 PID 4748 wrote to memory of 3496 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 111 PID 4748 wrote to memory of 3496 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 111 PID 4748 wrote to memory of 2008 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 114 PID 4748 wrote to memory of 2008 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 114 PID 4748 wrote to memory of 2008 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 114 PID 4748 wrote to memory of 916 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 117 PID 4748 wrote to memory of 916 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 117 PID 4748 wrote to memory of 916 4748 dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe 117 PID 916 wrote to memory of 4108 916 csrss.exe 118 PID 916 wrote to memory of 4108 916 csrss.exe 118 PID 916 wrote to memory of 4108 916 csrss.exe 118 PID 916 wrote to memory of 4180 916 csrss.exe 126 PID 916 wrote to memory of 4180 916 csrss.exe 126 PID 916 wrote to memory of 4180 916 csrss.exe 126 PID 916 wrote to memory of 4108 916 csrss.exe 129 PID 916 wrote to memory of 4108 916 csrss.exe 129 PID 916 wrote to memory of 4108 916 csrss.exe 129 PID 916 wrote to memory of 2232 916 csrss.exe 131 PID 916 wrote to memory of 2232 916 csrss.exe 131 PID 4704 wrote to memory of 2880 4704 windefender.exe 138 PID 4704 wrote to memory of 2880 4704 windefender.exe 138 PID 4704 wrote to memory of 2880 4704 windefender.exe 138 PID 2880 wrote to memory of 2240 2880 cmd.exe 140 PID 2880 wrote to memory of 2240 2880 cmd.exe 140 PID 2880 wrote to memory of 2240 2880 cmd.exe 140 PID 916 wrote to memory of 2788 916 csrss.exe 141 PID 916 wrote to memory of 2788 916 csrss.exe 141 PID 916 wrote to memory of 2788 916 csrss.exe 141 PID 2788 wrote to memory of 4892 2788 cmd.exe 143 PID 2788 wrote to memory of 4892 2788 cmd.exe 143 PID 2788 wrote to memory of 4892 2788 cmd.exe 143 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4448
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4540
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:856
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2936
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)4⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\sc.exesc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:60
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2.5MB
MD5093fba54ad4880806ee9cb8d0a0f9097
SHA1c3fb76aa4f14693481ff75c4d01ce3ebb1fc8838
SHA25628e1566107c68af138e4eb900f01a8ac962bc918e57c9e62ae89c30537a9c17c
SHA51223bdef893c6f93356d8d1c80f48b126d9139808f6611a4554c026772ada612b2140e7da1d46dbefaaa517477f29666ee464e59a899b03035f626cec62d777ea0
-
Filesize
4.7MB
MD59a1a2bf2682e72d64ec0dfec133ae0a8
SHA18b2bdab7b1d8a319e4896dbf8a3d55fb7022cc79
SHA25680ccd95dc124775d2defac623b6305f0d6add2ae619ca66d378397b98cf10a41
SHA5129fb50500a67cd45c8f8f60393047ad897a24928b8a4496612f6ead5383bc06527521f3812a5cf97f6444af3d884da81866482f84d78024719ffb696e14e9e015
-
Filesize
3.8MB
MD5c72911dec6ae8c4bc62bb2a6a21ba85b
SHA10ae7077313a53103c2b32100d74aafc04216289d
SHA2567e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f
SHA51299dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304
-
Filesize
5.6MB
MD5ed2f9b19dd1584d7e26f5ba460ef2fbf
SHA1dcbf1789bf1eeb03276b830cb2ab92bcf779d97f
SHA256f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add
SHA512dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856
-
Filesize
3.5MB
MD5b7c32c8e7d21aa9b79470037227eba43
SHA138d719b10ca035cee65162c1a44e2c62123d41b4
SHA25699b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23
SHA512d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7
-
Filesize
3.5MB
MD5b7c32c8e7d21aa9b79470037227eba43
SHA138d719b10ca035cee65162c1a44e2c62123d41b4
SHA25699b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23
SHA512d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7
-
Filesize
3.5MB
MD5b7c32c8e7d21aa9b79470037227eba43
SHA138d719b10ca035cee65162c1a44e2c62123d41b4
SHA25699b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23
SHA512d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7
-
Filesize
876KB
MD5736443b08b5a52b6958f001e8200be71
SHA1e56ddc8476aef0d3482c99c5bfaf0f57458b2576
SHA256da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4
SHA5129dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1
-
Filesize
876KB
MD5736443b08b5a52b6958f001e8200be71
SHA1e56ddc8476aef0d3482c99c5bfaf0f57458b2576
SHA256da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4
SHA5129dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1
-
Filesize
668KB
MD536e1c3814bde3418ba3d38517954cb7c
SHA1495e1ba5b0b442e70124d33daa6fea4e3e5931b0
SHA256b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1
SHA512df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0
-
Filesize
668KB
MD536e1c3814bde3418ba3d38517954cb7c
SHA1495e1ba5b0b442e70124d33daa6fea4e3e5931b0
SHA256b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1
SHA512df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0
-
Filesize
938KB
MD5d92e59b71bf8a0d827597ed95b2eca42
SHA1cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a
SHA256b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3
SHA512be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04
-
Filesize
938KB
MD5d92e59b71bf8a0d827597ed95b2eca42
SHA1cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a
SHA256b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3
SHA512be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04
-
Filesize
95KB
MD57cdbaca31739500aefc06dd85a8558ff
SHA1adc36ec6a3cdc7e57a1b706c820e382627f6cb90
SHA2560a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb
SHA5126df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba
-
Filesize
95KB
MD57cdbaca31739500aefc06dd85a8558ff
SHA1adc36ec6a3cdc7e57a1b706c820e382627f6cb90
SHA2560a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb
SHA5126df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba
-
Filesize
95KB
MD57cdbaca31739500aefc06dd85a8558ff
SHA1adc36ec6a3cdc7e57a1b706c820e382627f6cb90
SHA2560a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb
SHA5126df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba
-
Filesize
301KB
MD507f4bbf18077231cb44750684dd8daf4
SHA18560627e9e05d6022abdfe7e576856e91ac90188
SHA2564a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316
SHA51204e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151
-
Filesize
301KB
MD507f4bbf18077231cb44750684dd8daf4
SHA18560627e9e05d6022abdfe7e576856e91ac90188
SHA2564a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316
SHA51204e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151
-
Filesize
301KB
MD507f4bbf18077231cb44750684dd8daf4
SHA18560627e9e05d6022abdfe7e576856e91ac90188
SHA2564a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316
SHA51204e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151
-
Filesize
4.3MB
MD5055ae7c584a7b012955bf5d874f30cfa
SHA1f2b4d8c5307ff09607be929ec08fc2727bf03dcf
SHA256d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8
SHA512910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5
-
Filesize
4.3MB
MD5055ae7c584a7b012955bf5d874f30cfa
SHA1f2b4d8c5307ff09607be929ec08fc2727bf03dcf
SHA256d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8
SHA512910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5
-
Filesize
135KB
MD5f08b1f044c68770c190daf1eb1f3157e
SHA1f94103a542459d60434f9ddb6b5f45b11eae2923
SHA2561d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27
SHA5120667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c
-
Filesize
135KB
MD5f08b1f044c68770c190daf1eb1f3157e
SHA1f94103a542459d60434f9ddb6b5f45b11eae2923
SHA2561d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27
SHA5120667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c
-
Filesize
227B
MD517c2994d6a89cb7d277f1b3f0b49e5ed
SHA12a72ffc34cb2a7d7d3057f4725f2ac660a809158
SHA25638ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f
SHA512d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e3a433df6499cc7a7888b621b8f2bf93
SHA144c62d9441a5bf244889504ce16a9399ab286119
SHA256039d75699bef7ed8ae4ddd438df46d586fba28663723f93191db4a8db85a4f0b
SHA5123298c558bd36f66f98714e2482b200d0a8a3cc9a071b3a6d569f6c83caafb23efe51099dc7c45139dea6ed8bc77dbaf684964289f4037bf627b576fbe7dcae9d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53a6b3638107061748ea56ecc3c481721
SHA105f8f83b84838734f097bbe675ae3583dffcb12e
SHA2569a911eaf70cef5607887af79b265a8440c5d39acc44aa765bb054d224a3ebe61
SHA512b42e5f9f01235012ce8b97ffbf9800d0a867070521c61b8115967205ca888cbea5530d955cb0481f9d4ead955dffcd918bb1032106035974e0bd16ab68e8ab7a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58d89551dbe2abb37cfb4b30295e78a09
SHA16b09edb736bd9eda3a1316b62d99c935f00553b2
SHA2569ea70fa691dfbb014cc748189f4927613c4fb11efc038941e7c67060ee4db36f
SHA51256e9768fe298a9c47c01d6231c06cf2e31b3d0bfb0251c2921890f81724f702cc0341c1fca65db0789ea1b6435ee0d3ee7589a8174de88d169285b794565f840
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ccc45954d56455011b33b7e02d40282c
SHA14023125d389979905f0b2f252fb08a57b8e52681
SHA2565e9f329399cf6e66628b2e450f14820e63481095fb5f6756d007272a6d49c009
SHA5120388ef76ec3395b73a4542959a3d4b6640ac38e456026dc1711e5aaa39370f91a0c7f2977ce4253113fc603e995f2b8dda9ae0c79a026919fd36f481dfbb8ee2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5865f0ad832d2c2fb0a2dacfa42811c1f
SHA1c2daf1f40f62447c4b81266c9f1da180ca6698d3
SHA256377e60411ea5c3b6f4752665bc2228390b24eebdda4b057e3280476e66e23548
SHA512bb4909d85608d5fbe2d5392f8829cbed9abe500afc492185631124e33bffe32d5f9145e90b4e48498526d2276e1cdbd5379d8ee6aa0ff619b4a78955216ac1fb
-
Filesize
4.2MB
MD53a9c8143ac63b230dc602a2c2f9372de
SHA1e8f01d5e448bbc46df3708c586c46da8bb4bf7d4
SHA256dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500
SHA512b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8
-
Filesize
4.2MB
MD53a9c8143ac63b230dc602a2c2f9372de
SHA1e8f01d5e448bbc46df3708c586c46da8bb4bf7d4
SHA256dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500
SHA512b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec