Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 09:19
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231020-en
General
-
Target
file.exe
-
Size
289KB
-
MD5
868b8f185038654472a6579b9269df19
-
SHA1
1694bed39163d09ecfef89f2876cd3d2eb7608f9
-
SHA256
a647595e7316d00d459c41191fc8169ce5a3cfa357d5a9651b6f870d6e06f175
-
SHA512
f12ea8054aac24aee0dbfde52e826100c3e70bd70e8fef24b97fc87d55f3bd01de62323034676f3c697ac3254fecfaa6e30698c5bef3aa6e4ec88ce8e0e45a44
-
SSDEEP
3072:DeOMh0OnJpjO/UySoUXw0sIYje/DLKcBeaQ5mUQU8rQj+/:aOc0OJhOcyEs2LK8Hw8t
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
194.49.94.181:40264
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
djvu
http://zexeq.com/lancer/get.php
-
extension
.gycc
-
offline_id
nN1rRlTxKTPo66pmJEAHwufZ2Dhz4MsNxIlOk6t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CDZ4hMgp2X Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0829ASdw
Extracted
smokeloader
pub1
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral2/memory/4480-110-0x00000000048E0000-0x00000000049FB000-memory.dmp family_djvu behavioral2/memory/2636-115-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2636-118-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2636-121-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2636-128-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2636-167-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/452-199-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/452-200-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/452-202-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/2100-190-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2100-191-0x0000000002E40000-0x000000000372B000-memory.dmp family_glupteba behavioral2/memory/2100-192-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2100-234-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2100-269-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/820-279-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/820-333-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/820-382-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2992-422-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2992-485-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4744-55-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
F7EF.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ F7EF.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
F7EF.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion F7EF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion F7EF.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1B39.exe29F0.exeF230.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation 1B39.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation 29F0.exe Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation F230.exe -
Deletes itself 1 IoCs
Processes:
pid process 3092 -
Executes dropped EXE 21 IoCs
Processes:
F230.exeF7EF.exeFADE.exe1220.exe1B39.exe1FED.exe288c47bbc1871b439df19ff4df68f076.exeInstallSetup8.exe29F0.exeF230.exeBroom.exeF230.exewhtetst29F0.exeF230.exe288c47bbc1871b439df19ff4df68f076.execsrss.exe29F0.exeinjector.exewindefender.exewindefender.exepid process 4480 F230.exe 2808 F7EF.exe 3512 FADE.exe 5104 1220.exe 4916 1B39.exe 3600 1FED.exe 2100 288c47bbc1871b439df19ff4df68f076.exe 2768 InstallSetup8.exe 1236 29F0.exe 2636 F230.exe 4540 Broom.exe 5028 F230.exe 1584 whtetst 3536 29F0.exe 452 F230.exe 820 288c47bbc1871b439df19ff4df68f076.exe 2992 csrss.exe 4852 29F0.exe 1368 injector.exe 1108 windefender.exe 2444 windefender.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3308 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\F7EF.exe themida C:\Users\Admin\AppData\Local\Temp\F7EF.exe themida behavioral2/memory/2808-46-0x0000000000D90000-0x00000000015C2000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
F230.exe288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\44837d2c-accf-4fca-8ec8-d209969c5c3e\\F230.exe\" --AutoStart" F230.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
F7EF.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F7EF.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 71 api.2ip.ua 72 api.2ip.ua -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
F7EF.exepid process 2808 F7EF.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
FADE.exeF230.exeF230.exe1FED.exeAddInProcess32.exedescription pid process target process PID 3512 set thread context of 4744 3512 FADE.exe AppLaunch.exe PID 4480 set thread context of 2636 4480 F230.exe F230.exe PID 5028 set thread context of 452 5028 F230.exe F230.exe PID 3600 set thread context of 2104 3600 1FED.exe AddInProcess32.exe PID 3600 set thread context of 4360 3600 1FED.exe AddInProcess32.exe PID 2104 set thread context of 1772 2104 AddInProcess32.exe InstallUtil.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
288c47bbc1871b439df19ff4df68f076.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe -
Drops file in Windows directory 4 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 288c47bbc1871b439df19ff4df68f076.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4504 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2304 452 WerFault.exe F230.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1220.exewhtetstfile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1220.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whtetst Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whtetst Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whtetst -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4408 schtasks.exe 1784 schtasks.exe 4164 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 288c47bbc1871b439df19ff4df68f076.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 3708 file.exe 3708 file.exe 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3092 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
file.exe1220.exewhtetstpid process 3708 file.exe 3092 3092 3092 3092 5104 1220.exe 1584 whtetst -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1FED.exeF7EF.exeAppLaunch.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exeAddInProcess32.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 3600 1FED.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 2808 F7EF.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 4744 AppLaunch.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 2476 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 2100 288c47bbc1871b439df19ff4df68f076.exe Token: SeImpersonatePrivilege 2100 288c47bbc1871b439df19ff4df68f076.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 4884 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 3776 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 2104 AddInProcess32.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 4288 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeDebugPrivilege 2316 powershell.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeSystemEnvironmentPrivilege 2992 csrss.exe Token: SeSecurityPrivilege 4504 sc.exe Token: SeSecurityPrivilege 4504 sc.exe Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 4540 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3092 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeFADE.exe1B39.exeF230.exeInstallSetup8.exe29F0.exedescription pid process target process PID 3092 wrote to memory of 4480 3092 F230.exe PID 3092 wrote to memory of 4480 3092 F230.exe PID 3092 wrote to memory of 4480 3092 F230.exe PID 3092 wrote to memory of 3176 3092 regsvr32.exe PID 3092 wrote to memory of 3176 3092 regsvr32.exe PID 3176 wrote to memory of 3308 3176 regsvr32.exe regsvr32.exe PID 3176 wrote to memory of 3308 3176 regsvr32.exe regsvr32.exe PID 3176 wrote to memory of 3308 3176 regsvr32.exe regsvr32.exe PID 3092 wrote to memory of 2808 3092 F7EF.exe PID 3092 wrote to memory of 2808 3092 F7EF.exe PID 3092 wrote to memory of 2808 3092 F7EF.exe PID 3092 wrote to memory of 3512 3092 FADE.exe PID 3092 wrote to memory of 3512 3092 FADE.exe PID 3092 wrote to memory of 3512 3092 FADE.exe PID 3512 wrote to memory of 3496 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 3496 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 3496 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3512 wrote to memory of 4744 3512 FADE.exe AppLaunch.exe PID 3092 wrote to memory of 5104 3092 1220.exe PID 3092 wrote to memory of 5104 3092 1220.exe PID 3092 wrote to memory of 5104 3092 1220.exe PID 3092 wrote to memory of 4916 3092 1B39.exe PID 3092 wrote to memory of 4916 3092 1B39.exe PID 3092 wrote to memory of 4916 3092 1B39.exe PID 3092 wrote to memory of 3600 3092 1FED.exe PID 3092 wrote to memory of 3600 3092 1FED.exe PID 3092 wrote to memory of 3600 3092 1FED.exe PID 4916 wrote to memory of 2100 4916 1B39.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4916 wrote to memory of 2100 4916 1B39.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4916 wrote to memory of 2100 4916 1B39.exe 288c47bbc1871b439df19ff4df68f076.exe PID 4916 wrote to memory of 2768 4916 1B39.exe InstallSetup8.exe PID 4916 wrote to memory of 2768 4916 1B39.exe InstallSetup8.exe PID 4916 wrote to memory of 2768 4916 1B39.exe InstallSetup8.exe PID 3092 wrote to memory of 1236 3092 29F0.exe PID 3092 wrote to memory of 1236 3092 29F0.exe PID 3092 wrote to memory of 1236 3092 29F0.exe PID 3092 wrote to memory of 4952 3092 explorer.exe PID 3092 wrote to memory of 4952 3092 explorer.exe PID 3092 wrote to memory of 4952 3092 explorer.exe PID 3092 wrote to memory of 4952 3092 explorer.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 4480 wrote to memory of 2636 4480 F230.exe F230.exe PID 3092 wrote to memory of 4048 3092 explorer.exe PID 3092 wrote to memory of 4048 3092 explorer.exe PID 3092 wrote to memory of 4048 3092 explorer.exe PID 2768 wrote to memory of 4540 2768 InstallSetup8.exe Broom.exe PID 2768 wrote to memory of 4540 2768 InstallSetup8.exe Broom.exe PID 2768 wrote to memory of 4540 2768 InstallSetup8.exe Broom.exe PID 1236 wrote to memory of 4164 1236 29F0.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F230.exeC:\Users\Admin\AppData\Local\Temp\F230.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F230.exeC:\Users\Admin\AppData\Local\Temp\F230.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\44837d2c-accf-4fca-8ec8-d209969c5c3e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\F230.exe"C:\Users\Admin\AppData\Local\Temp\F230.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\F230.exe"C:\Users\Admin\AppData\Local\Temp\F230.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 5685⤵
- Program crash
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\F492.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\F492.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\F7EF.exeC:\Users\Admin\AppData\Local\Temp\F7EF.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FADE.exeC:\Users\Admin\AppData\Local\Temp\FADE.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1220.exeC:\Users\Admin\AppData\Local\Temp\1220.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1B39.exeC:\Users\Admin\AppData\Local\Temp\1B39.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1FED.exeC:\Users\Admin\AppData\Local\Temp\1FED.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeC:\Users\Admin\AppData\Local\Temp\29F0.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 29F0.exe /TR "C:\Users\Admin\AppData\Local\Temp\29F0.exe" /F2⤵
- Creates scheduled task(s)
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\whtetstC:\Users\Admin\AppData\Roaming\whtetst1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeC:\Users\Admin\AppData\Local\Temp\29F0.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 4521⤵
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeC:\Users\Admin\AppData\Local\Temp\29F0.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
1File and Directory Permissions Modification
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\44837d2c-accf-4fca-8ec8-d209969c5c3e\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\1220.exeFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Users\Admin\AppData\Local\Temp\1220.exeFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Users\Admin\AppData\Local\Temp\1B39.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\1B39.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\1FED.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\1FED.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\29F0.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\F230.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\F492.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\F492.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\F7EF.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\F7EF.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\FADE.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\FADE.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjqq4rel.zbe.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Roaming\ehtetstFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Users\Admin\AppData\Roaming\whtetstFilesize
289KB
MD5868b8f185038654472a6579b9269df19
SHA11694bed39163d09ecfef89f2876cd3d2eb7608f9
SHA256a647595e7316d00d459c41191fc8169ce5a3cfa357d5a9651b6f870d6e06f175
SHA512f12ea8054aac24aee0dbfde52e826100c3e70bd70e8fef24b97fc87d55f3bd01de62323034676f3c697ac3254fecfaa6e30698c5bef3aa6e4ec88ce8e0e45a44
-
C:\Users\Admin\AppData\Roaming\whtetstFilesize
289KB
MD5868b8f185038654472a6579b9269df19
SHA11694bed39163d09ecfef89f2876cd3d2eb7608f9
SHA256a647595e7316d00d459c41191fc8169ce5a3cfa357d5a9651b6f870d6e06f175
SHA512f12ea8054aac24aee0dbfde52e826100c3e70bd70e8fef24b97fc87d55f3bd01de62323034676f3c697ac3254fecfaa6e30698c5bef3aa6e4ec88ce8e0e45a44
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD55200de3c347cbb567396ff377da85b2f
SHA1f595c83e0859bac00d920075533d2381d32144a1
SHA256c92a4c78ad9c454bcd6d731804e27a9cc4118f4dd4d3e1a35cc06a43cccc5e0c
SHA51251ff143c62674fa7761386a67af1ed488ebb707ab5d3f323b9c9b51201e97e1b36fcfd55c7ca91803a2513aae0e97c088832cc8005b136691ee502405fcb4502
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5662bd9654d6cf7b4271c06175ad7e504
SHA17621ee391fb3fdec426a178191496d5476b78aac
SHA256036ae5f2c18bd8f2e3991ce857102595691f24d392c6add078eda06b5fa4b993
SHA512ae12e51dd9d29f62ebe7a2f342977030370f4284ad3657cc08ee11ca8af72bc6e2d928158f05a6e7fba5a17e41daff9f80f18f80ba6616b3ea61c4c634e9d0c8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54e5a87192c7e1f846c6461b7965652ef
SHA14a206b6742a051bededebb86eba799299253775c
SHA25695017ff0432469fe072f5eadf29ca7282f6d08f0371bc2b44310a751f81dc8e1
SHA5125051662ceabcb51f3b9df8b8ab3abd0f09b9b394cc92d5db54dca753b3ba78e4646a4458415577ae05cb96dfe4b0ff25a45c3cbc528b8997c7a283bf133ce182
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a090e8cc3f12fa4792246b9f82c5ed27
SHA1e5967f700f30e2a1dac6581d9d8847e23dcb4468
SHA256f7ac68ad066527194a2fbd96aec85e39929eca39a4dce07955133a19e021534c
SHA5125a502fa6e898f11898b997554d6a3906b98cadda71d3448a653a7bfe825648d36d735c95f41d6b59908e57049bb44912bed285da823b7020683c1351576a2672
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5eb278f2d9678f1a7481c7b7398a6ae03
SHA1e2717ee251990281bc518114b51d7e794eb437db
SHA2561755469089b161f0959902cdbb5501b9a404adc8e1c2a6c8247b5c38bd3beceb
SHA512f093b70e808140bb1f3bf8cf90bb4c8c8ea6e6c090702129a514d665aa4f2efcaf2e9937fe1ef6bb35729916be915c18eb5c3111bc9867fa2fe6361ada850eed
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/452-199-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/452-202-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/452-200-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/820-279-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/820-333-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/820-382-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1584-276-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/2100-191-0x0000000002E40000-0x000000000372B000-memory.dmpFilesize
8.9MB
-
memory/2100-189-0x0000000002A30000-0x0000000002E36000-memory.dmpFilesize
4.0MB
-
memory/2100-190-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2100-192-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2100-234-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2100-269-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2104-386-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/2104-383-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/2636-121-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2636-167-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2636-128-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2636-115-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2636-118-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2808-135-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-48-0x0000000007DD0000-0x0000000007E62000-memory.dmpFilesize
584KB
-
memory/2808-34-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-124-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-35-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-126-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-30-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-119-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-37-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-134-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-184-0x0000000006CB0000-0x0000000006E72000-memory.dmpFilesize
1.8MB
-
memory/2808-38-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-39-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-40-0x0000000076FA4000-0x0000000076FA6000-memory.dmpFilesize
8KB
-
memory/2808-70-0x0000000000D90000-0x00000000015C2000-memory.dmpFilesize
8.2MB
-
memory/2808-46-0x0000000000D90000-0x00000000015C2000-memory.dmpFilesize
8.2MB
-
memory/2808-47-0x00000000082E0000-0x0000000008884000-memory.dmpFilesize
5.6MB
-
memory/2808-31-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-81-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-105-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-29-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-49-0x0000000007D80000-0x0000000007D8A000-memory.dmpFilesize
40KB
-
memory/2808-165-0x0000000009860000-0x00000000098B0000-memory.dmpFilesize
320KB
-
memory/2808-187-0x00000000073B0000-0x00000000078DC000-memory.dmpFilesize
5.2MB
-
memory/2808-96-0x0000000076CB0000-0x0000000076DA0000-memory.dmpFilesize
960KB
-
memory/2808-50-0x0000000008EB0000-0x00000000094C8000-memory.dmpFilesize
6.1MB
-
memory/2808-51-0x00000000080C0000-0x00000000081CA000-memory.dmpFilesize
1.0MB
-
memory/2808-52-0x0000000007FF0000-0x0000000008002000-memory.dmpFilesize
72KB
-
memory/2808-53-0x0000000008050000-0x000000000808C000-memory.dmpFilesize
240KB
-
memory/2808-54-0x00000000081D0000-0x000000000821C000-memory.dmpFilesize
304KB
-
memory/2808-28-0x0000000000D90000-0x00000000015C2000-memory.dmpFilesize
8.2MB
-
memory/2808-90-0x0000000008A50000-0x0000000008AB6000-memory.dmpFilesize
408KB
-
memory/2992-485-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2992-422-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3092-275-0x0000000002CC0000-0x0000000002CD6000-memory.dmpFilesize
88KB
-
memory/3092-179-0x0000000002DA0000-0x0000000002DB6000-memory.dmpFilesize
88KB
-
memory/3092-4-0x0000000002D70000-0x0000000002D86000-memory.dmpFilesize
88KB
-
memory/3308-61-0x0000000002AE0000-0x0000000002C0D000-memory.dmpFilesize
1.2MB
-
memory/3308-21-0x0000000002970000-0x0000000002976000-memory.dmpFilesize
24KB
-
memory/3308-22-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/3308-83-0x0000000002C20000-0x0000000002D30000-memory.dmpFilesize
1.1MB
-
memory/3308-75-0x0000000002C20000-0x0000000002D30000-memory.dmpFilesize
1.1MB
-
memory/3308-68-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/3308-69-0x0000000002C20000-0x0000000002D30000-memory.dmpFilesize
1.1MB
-
memory/3600-82-0x0000000000390000-0x0000000000558000-memory.dmpFilesize
1.8MB
-
memory/3600-84-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/3600-195-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/3600-85-0x0000000004A70000-0x0000000004B0C000-memory.dmpFilesize
624KB
-
memory/3600-156-0x00000000058F0000-0x0000000005934000-memory.dmpFilesize
272KB
-
memory/3600-95-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/3708-3-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/3708-5-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/3708-2-0x0000000004800000-0x000000000480B000-memory.dmpFilesize
44KB
-
memory/3708-1-0x0000000002BF0000-0x0000000002CF0000-memory.dmpFilesize
1024KB
-
memory/4048-145-0x00000000007E0000-0x00000000007EC000-memory.dmpFilesize
48KB
-
memory/4048-130-0x00000000007E0000-0x00000000007EC000-memory.dmpFilesize
48KB
-
memory/4480-110-0x00000000048E0000-0x00000000049FB000-memory.dmpFilesize
1.1MB
-
memory/4480-106-0x0000000004840000-0x00000000048DE000-memory.dmpFilesize
632KB
-
memory/4540-263-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/4540-194-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/4540-152-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/4540-186-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/4744-188-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4744-173-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/4744-60-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/4744-55-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4744-62-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4916-113-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/4916-74-0x0000000072BA0000-0x0000000073350000-memory.dmpFilesize
7.7MB
-
memory/4916-67-0x0000000000810000-0x0000000000E84000-memory.dmpFilesize
6.5MB
-
memory/4952-116-0x00000000008B0000-0x000000000091B000-memory.dmpFilesize
428KB
-
memory/4952-123-0x00000000008B0000-0x000000000091B000-memory.dmpFilesize
428KB
-
memory/4952-122-0x00000000048E0000-0x00000000049FB000-memory.dmpFilesize
1.1MB
-
memory/4952-163-0x00000000008B0000-0x000000000091B000-memory.dmpFilesize
428KB
-
memory/5028-197-0x00000000046F0000-0x0000000004785000-memory.dmpFilesize
596KB
-
memory/5104-172-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/5104-175-0x0000000002BD0000-0x0000000002BDB000-memory.dmpFilesize
44KB
-
memory/5104-181-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/5104-174-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB