glupteba | 121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30

Analysis

max time kernel
300s
max time network
298s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
27/11/2023, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe
Size

12.2MB
MD5

a9c5d3db8ea47ab1e03cbf5a91065d24
SHA1

5e01d907db57d5f12410bc1743d37b803cdaf29d
SHA256

121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30
SHA512

3b337def8baf65a768f47f7687f3981cfeae540b8736e87fe355e652a26069dbb8eec249610d9ad262dd033fb3e46afdaa90efcb941065f9967a0b52e422a3af
SSDEEP

393216:FmL5LvPmm1SPtqMOL7JTa/l8ua1ipeE/Dl3uh1:FS5jXMt3OL7ta/mtJgDlez

Score

10^/10

glupteba smokeloader xmrig up3 backdoor discovery dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

resource	yara_rule
behavioral2/memory/3008-35-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral2/memory/3008-36-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3008-105-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3008-342-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3008-343-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral2/memory/3008-347-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4192-352-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4192-434-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4192-956-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4192-1205-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-1238-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-1733-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2374-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2419-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2425-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2430-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2443-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4288-2452-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 1236 created 3308	1236	latestX.exe	54
PID 1236 created 3308	1236	latestX.exe	54
PID 1236 created 3308	1236	latestX.exe	54
PID 1236 created 3308	1236	latestX.exe	54
PID 1236 created 3308	1236	latestX.exe	54
PID 4476 created 3308	4476	updater.exe	54
PID 4476 created 3308	4476	updater.exe	54
PID 4476 created 3308	4476	updater.exe	54
PID 4476 created 3308	4476	updater.exe	54
PID 4476 created 3308	4476	updater.exe	54
PID 4476 created 3308	4476	updater.exe	54

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4476-2405-0x00007FF789DC0000-0x00007FF78A361000-memory.dmp	xmrig
behavioral2/memory/4672-2422-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp	xmrig
behavioral2/memory/4672-2427-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp	xmrig
behavioral2/memory/4672-2432-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp	xmrig
behavioral2/memory/4672-2445-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp	xmrig
behavioral2/memory/4672-2455-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp	xmrig

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1648	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 15 IoCs

pid	Process
3028	InstallSetup5.exe
5080	toolspub2.exe
3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1236	latestX.exe
1868	Broom.exe
440	toolspub2.exe
4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4476	updater.exe
4288	csrss.exe
3608	injector.exe
4980	windefender.exe
4360	windefender.exe
4160	cdthvvd
2376	cdthvvd
988	f801950a962ddba14caaa44bf084b55c.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000001abfe-2413.dat	upx
behavioral2/files/0x000800000001abfe-2415.dat	upx
behavioral2/files/0x000800000001abfe-2416.dat	upx
behavioral2/memory/4980-2418-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4360-2423-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4360-2436-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000600000000069f-2713.dat	upx
behavioral2/files/0x000600000000069f-2715.dat	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 440	5080	toolspub2.exe	76
PID 4476 set thread context of 2516	4476	updater.exe	144
PID 4476 set thread context of 4672	4476	updater.exe	145
PID 4160 set thread context of 2376	4160	cdthvvd	155

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1856	sc.exe
2172	sc.exe
1160	sc.exe
4140	sc.exe
2140	sc.exe
3036	sc.exe
1044	sc.exe
1452	sc.exe
4392	sc.exe
1300	sc.exe
876	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cdthvvd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cdthvvd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cdthvvd

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3700	schtasks.exe
428	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-572 = "China Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
440	toolspub2.exe
440	toolspub2.exe
4848	powershell.exe
4848	powershell.exe
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
4848	powershell.exe
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3308	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
440	toolspub2.exe
2376	cdthvvd

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeIncreaseQuotaPrivilege	1808	powershell.exe
Token: SeSecurityPrivilege	1808	powershell.exe
Token: SeTakeOwnershipPrivilege	1808	powershell.exe
Token: SeLoadDriverPrivilege	1808	powershell.exe
Token: SeSystemProfilePrivilege	1808	powershell.exe
Token: SeSystemtimePrivilege	1808	powershell.exe
Token: SeProfSingleProcessPrivilege	1808	powershell.exe
Token: SeIncBasePriorityPrivilege	1808	powershell.exe
Token: SeCreatePagefilePrivilege	1808	powershell.exe
Token: SeBackupPrivilege	1808	powershell.exe
Token: SeRestorePrivilege	1808	powershell.exe
Token: SeShutdownPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeSystemEnvironmentPrivilege	1808	powershell.exe
Token: SeRemoteShutdownPrivilege	1808	powershell.exe
Token: SeUndockPrivilege	1808	powershell.exe
Token: SeManageVolumePrivilege	1808	powershell.exe
Token: 33	1808	powershell.exe
Token: 34	1808	powershell.exe
Token: 35	1808	powershell.exe
Token: 36	1808	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	164	powershell.exe
Token: SeShutdownPrivilege	68	powercfg.exe
Token: SeCreatePagefilePrivilege	68	powercfg.exe
Token: SeShutdownPrivilege	2344	powercfg.exe
Token: SeCreatePagefilePrivilege	2344	powercfg.exe
Token: SeShutdownPrivilege	4996	powercfg.exe
Token: SeCreatePagefilePrivilege	4996	powercfg.exe
Token: SeShutdownPrivilege	3828	powercfg.exe
Token: SeCreatePagefilePrivilege	3828	powercfg.exe
Token: SeIncreaseQuotaPrivilege	164	powershell.exe
Token: SeSecurityPrivilege	164	powershell.exe
Token: SeTakeOwnershipPrivilege	164	powershell.exe
Token: SeLoadDriverPrivilege	164	powershell.exe
Token: SeSystemProfilePrivilege	164	powershell.exe
Token: SeSystemtimePrivilege	164	powershell.exe
Token: SeProfSingleProcessPrivilege	164	powershell.exe
Token: SeIncBasePriorityPrivilege	164	powershell.exe
Token: SeCreatePagefilePrivilege	164	powershell.exe
Token: SeBackupPrivilege	164	powershell.exe
Token: SeRestorePrivilege	164	powershell.exe
Token: SeShutdownPrivilege	164	powershell.exe
Token: SeDebugPrivilege	164	powershell.exe
Token: SeSystemEnvironmentPrivilege	164	powershell.exe
Token: SeRemoteShutdownPrivilege	164	powershell.exe
Token: SeUndockPrivilege	164	powershell.exe
Token: SeManageVolumePrivilege	164	powershell.exe
Token: 33	164	powershell.exe
Token: 34	164	powershell.exe
Token: 35	164	powershell.exe
Token: 36	164	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	164	powershell.exe
Token: SeSecurityPrivilege	164	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3028	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	71
PID 1344 wrote to memory of 3028	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	71
PID 1344 wrote to memory of 3028	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	71
PID 1344 wrote to memory of 5080	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	72
PID 1344 wrote to memory of 5080	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	72
PID 1344 wrote to memory of 5080	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	72
PID 1344 wrote to memory of 3008	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	73
PID 1344 wrote to memory of 3008	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	73
PID 1344 wrote to memory of 3008	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	73
PID 1344 wrote to memory of 1236	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	74
PID 1344 wrote to memory of 1236	1344	121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe	74
PID 3028 wrote to memory of 1868	3028	InstallSetup5.exe	75
PID 3028 wrote to memory of 1868	3028	InstallSetup5.exe	75
PID 3028 wrote to memory of 1868	3028	InstallSetup5.exe	75
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 5080 wrote to memory of 440	5080	toolspub2.exe	76
PID 3008 wrote to memory of 4848	3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe	78
PID 3008 wrote to memory of 4848	3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe	78
PID 3008 wrote to memory of 4848	3008	d21cbe21e38b385a41a68c5e6dd32f4c.exe	78
PID 4192 wrote to memory of 3468	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	83
PID 4192 wrote to memory of 3468	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	83
PID 4192 wrote to memory of 3468	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	83
PID 2040 wrote to memory of 2172	2040	cmd.exe	90
PID 2040 wrote to memory of 2172	2040	cmd.exe	90
PID 2040 wrote to memory of 1160	2040	cmd.exe	91
PID 2040 wrote to memory of 1160	2040	cmd.exe	91
PID 2040 wrote to memory of 1452	2040	cmd.exe	92
PID 2040 wrote to memory of 1452	2040	cmd.exe	92
PID 2040 wrote to memory of 4140	2040	cmd.exe	93
PID 2040 wrote to memory of 4140	2040	cmd.exe	93
PID 2040 wrote to memory of 4392	2040	cmd.exe	94
PID 2040 wrote to memory of 4392	2040	cmd.exe	94
PID 960 wrote to memory of 68	960	cmd.exe	99
PID 960 wrote to memory of 68	960	cmd.exe	99
PID 960 wrote to memory of 2344	960	cmd.exe	100
PID 960 wrote to memory of 2344	960	cmd.exe	100
PID 4192 wrote to memory of 2376	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	101
PID 4192 wrote to memory of 2376	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	101
PID 960 wrote to memory of 4996	960	cmd.exe	103
PID 960 wrote to memory of 4996	960	cmd.exe	103
PID 960 wrote to memory of 3828	960	cmd.exe	104
PID 960 wrote to memory of 3828	960	cmd.exe	104
PID 2376 wrote to memory of 1648	2376	cmd.exe	105
PID 2376 wrote to memory of 1648	2376	cmd.exe	105
PID 4192 wrote to memory of 2324	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	106
PID 4192 wrote to memory of 2324	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	106
PID 4192 wrote to memory of 2324	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	106
PID 4192 wrote to memory of 3620	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	111
PID 4192 wrote to memory of 3620	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	111
PID 4192 wrote to memory of 3620	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	111
PID 4192 wrote to memory of 4288	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	113
PID 4192 wrote to memory of 4288	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	113
PID 4192 wrote to memory of 4288	4192	d21cbe21e38b385a41a68c5e6dd32f4c.exe	113
PID 4288 wrote to memory of 1552	4288	csrss.exe	114
PID 4288 wrote to memory of 1552	4288	csrss.exe	114
PID 4288 wrote to memory of 1552	4288	csrss.exe	114
PID 4288 wrote to memory of 2696	4288	csrss.exe	120
PID 4288 wrote to memory of 2696	4288	csrss.exe	120
PID 4288 wrote to memory of 2696	4288	csrss.exe	120
PID 4288 wrote to memory of 3780	4288	csrss.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3308
- C:\Users\Admin\AppData\Local\Temp\121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe
  "C:\Users\Admin\AppData\Local\Temp\121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
      C:\Users\Admin\AppData\Local\Temp\Broom.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:440
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
      "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:1648
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2324
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3620
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1552
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3700
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2740
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2696
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:3608
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:428
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1044
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
        6⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "csrss" /f
        7⤵
        
        PID:4796
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "ScheduledUpdate" /f
        7⤵
        
        PID:3952
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2172
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1160
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1452
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4140
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4392
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:68
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:164
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1656
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2140
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1300
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:876
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3036
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1856
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3360
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:380
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:1156
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4668
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5028
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2516
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4672

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4476

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4360

C:\Users\Admin\AppData\Roaming\cdthvvd
C:\Users\Admin\AppData\Roaming\cdthvvd
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4160
- C:\Users\Admin\AppData\Roaming\cdthvvd
  C:\Users\Admin\AppData\Roaming\cdthvvd
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
82b121db90d0f124fab8f375aa635169

SHA1
15b75b162b1547d786abcb0ac03c0b4587d06ac1

SHA256
09f859cdb7f7838f108d6ba2f542cd13a17563c69e62f082e84ed0de0ab785fa

SHA512
0d74a67f56949314d689cd1663c86fd97ca7974dcb7f9b28a766e61fd4fcd283163aefdab1700babc457cc053257a66460d22790c57be1e70a71d261dba76ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Broom.exe

Filesize
5.3MB

MD5
00e93456aa5bcf9f60f84b0c0760a212

SHA1
6096890893116e75bd46fea0b8c3921ceb33f57d

SHA256
ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

SHA512
abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.2MB

MD5
7714dff962cf31af75abf7f7a58166ef

SHA1
7ccc3e3189bb80bbcedf144a49d8dcdbe93bb9e4

SHA256
377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4

SHA512
ff7aa6865cea87870dab45aac7ae98f799952b56aacd15b55b610994675ae1c1f4ed3600d8bf098bf988bf87f59163fded37defa5acf2e9a6e4073c8eb469f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.2MB

MD5
7714dff962cf31af75abf7f7a58166ef

SHA1
7ccc3e3189bb80bbcedf144a49d8dcdbe93bb9e4

SHA256
377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4

SHA512
ff7aa6865cea87870dab45aac7ae98f799952b56aacd15b55b610994675ae1c1f4ed3600d8bf098bf988bf87f59163fded37defa5acf2e9a6e4073c8eb469f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ednacn4x.hi0.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

Filesize
99KB

MD5
09031a062610d77d685c9934318b4170

SHA1
880f744184e7774f3d14c1bb857e21cc7fe89a6d

SHA256
778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd

SHA512
9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Roaming\cdthvvd

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Roaming\cdthvvd

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Roaming\cdthvvd

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Users\Admin\AppData\Roaming\cdthvvd

Filesize
201KB

MD5
f4c628f4d34d9837cb7183aa3b9693ea

SHA1
4825f3969bc90537f6cf975d3d57668271e47ca2

SHA256
199dec9813b83d29516be695efff5c27e090b5853abb9c5d64058c893cbcfa9a

SHA512
edd6eaf6c9224e8c4bc27e0db6871d7a1f4ce8c91757e0b52ef30b813aab174ba199baf70ace93d23fbef6370200371831755d4c237ad76a5f04e3703680866c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b06cf9dac10a7f42677666a708864b6f

SHA1
273bb5b3dea08689ac495e97aa6ad4a98d45bea0

SHA256
42f1b004b2ce73998401340a67ede99c09e647d97213725315934007d51827d3

SHA512
13fde01a7e047257bde5fee6dfdb61ddf8958147d721be720b4221e6957a7c7db7b73fbc771450e85b18798a9ed1f6432287432ce670bc7306cf025e832a6359

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d0192def2de3f87950afa70577872a2b

SHA1
779629d472bf37c1cedf4455c3d8b84a42933c2f

SHA256
3a639bce8d4e4a5d60e96bc6e5503a1db752f354e6d7d20d140e0d344fa249c7

SHA512
020abae5b8cdc6c74c72818e055eaedca729ab1c7d677740fa7945c07522f1e5a515b26e3d5ab2e57f51d4269b818c48ab22b5ee8e86a24c679efaacffb35448

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
ebd3f65d9ae207b5916aea75bab8ed9e

SHA1
719fca5b204f80f18892d00095a794ec4e9d4ffe

SHA256
2c1f7f9e324abf5d013d81481f4c22e96b9b16fa20114599a190832aba34cb49

SHA512
d1ce670b00ae71e6e75d1c81603c4de23709bfd8ed6ab0d5fadfd9db8294ded3c40043eb037bde9b494d135d3e47faf0a4993e88a7a582ccc36e2e60e33a85e5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
25a776fd9029d6af15c7a1f325405e2f

SHA1
60e3aee94b4f45f61987ea966212bd218e0afd77

SHA256
32a07110cc9c83b8dfbc6585aaaa943ad45b64d46f076e62205516d93b8201d0

SHA512
be10d873560d8468e30937706ebddde1940e8837b42b2f9100bd193f605dbfa2a4fb43f0ff62abf2ac11fcc4839dd8bdcee0c33870c03ec452054a41e2906ab4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
4272ed2c389e8d68ead3c2bb3d487149

SHA1
96190aec81354e0ff014f23d09de8bba2e45275b

SHA256
081bd53b3f106bb648a3572ec4c3be76d8a366c3a054d320f1e41ed3da488fa3

SHA512
dd3488236086402895b4d855504924aedfc1798d37fabd79ecf5377bb830af2b7c526e94cad73591dac52b0f055e51e734b79f9821bb0d383f3186c2746e5e5d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
842bf314cedc595d1cb9f44508af9d4d

SHA1
125a95ab7e08a39e1d833d2435731d000b54ba63

SHA256
68053cea06387b796955a8e8ad2aba808a83838c9fdb5e7b8bcdd8e96cc2fb26

SHA512
94f66e913deee7c7c934ad6addb6a2f85df974b0f0ce3f40162b433865239c42df0e425053aa8920855cc00b8ae7d26c297baf8b5698f857fc6b45ed257fa708

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
949ec0b69598677e2a1413d267e96c29

SHA1
bf67d63774bb568441bdd3357d9af1c8a36c8912

SHA256
e3782310fc1c0bf50b836e4bee87785564b4d0b05c87d363651164fc9dc64d67

SHA512
4e5c53d4e57890543665fa7e083de2159ebd9a3a1433d1e10a65f37f887c09f01ddcb3a69223a45514f7f0285882924da97dbf41ff1939df79278d18c1a7ca7e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/164-666-0x0000027940CF0000-0x0000027940D00000-memory.dmp

Filesize
64KB

Download
memory/164-682-0x0000027940CF0000-0x0000027940D00000-memory.dmp

Filesize
64KB

Download
memory/164-665-0x0000027940CF0000-0x0000027940D00000-memory.dmp

Filesize
64KB

Download
memory/164-663-0x00007FF8C77B0000-0x00007FF8C819C000-memory.dmp

Filesize
9.9MB

Download
memory/440-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/440-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/440-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1236-726-0x00007FF7CDFA0000-0x00007FF7CE541000-memory.dmp

Filesize
5.6MB

Download
memory/1236-106-0x00007FF7CDFA0000-0x00007FF7CE541000-memory.dmp

Filesize
5.6MB

Download
memory/1344-25-0x0000000073860000-0x0000000073F4E000-memory.dmp

Filesize
6.9MB

Download
memory/1344-0-0x0000000073860000-0x0000000073F4E000-memory.dmp

Filesize
6.9MB

Download
memory/1344-1-0x0000000000F20000-0x0000000001B52000-memory.dmp

Filesize
12.2MB

Download
memory/1808-440-0x000002E5F1DA0000-0x000002E5F1DB0000-memory.dmp

Filesize
64KB

Download
memory/1808-620-0x00007FF8C77B0000-0x00007FF8C819C000-memory.dmp

Filesize
9.9MB

Download
memory/1808-438-0x000002E5F1DA0000-0x000002E5F1DB0000-memory.dmp

Filesize
64KB

Download
memory/1808-455-0x000002E5F1DE0000-0x000002E5F1E02000-memory.dmp

Filesize
136KB

Download
memory/1808-432-0x00007FF8C77B0000-0x00007FF8C819C000-memory.dmp

Filesize
9.9MB

Download
memory/1808-462-0x000002E5F1F90000-0x000002E5F2006000-memory.dmp

Filesize
472KB

Download
memory/1808-485-0x000002E5F1DA0000-0x000002E5F1DB0000-memory.dmp

Filesize
64KB

Download
memory/1808-599-0x000002E5F1DA0000-0x000002E5F1DB0000-memory.dmp

Filesize
64KB

Download
memory/1868-1810-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/1868-26-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/1868-124-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/1868-2424-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/1868-349-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/1868-107-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/2324-700-0x0000000073000000-0x00000000736EE000-memory.dmp

Filesize
6.9MB

Download
memory/2324-701-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/2376-2449-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2516-2454-0x00007FF63D2C0000-0x00007FF63D2EA000-memory.dmp

Filesize
168KB

Download
memory/2516-2421-0x00007FF63D2C0000-0x00007FF63D2EA000-memory.dmp

Filesize
168KB

Download
memory/3008-35-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/3008-34-0x00000000029E0000-0x0000000002DDB000-memory.dmp

Filesize
4.0MB

Download
memory/3008-105-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3008-343-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/3008-347-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3008-36-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3008-333-0x00000000029E0000-0x0000000002DDB000-memory.dmp

Filesize
4.0MB

Download
memory/3008-342-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3308-50-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/3308-2446-0x0000000000960000-0x0000000000976000-memory.dmp

Filesize
88KB

Download
memory/3468-355-0x0000000073000000-0x00000000736EE000-memory.dmp

Filesize
6.9MB

Download
memory/3468-390-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/3468-384-0x000000006F260000-0x000000006F5B0000-memory.dmp

Filesize
3.3MB

Download
memory/3468-382-0x00000000711F0000-0x000000007123B000-memory.dmp

Filesize
300KB

Download
memory/3468-660-0x0000000073000000-0x00000000736EE000-memory.dmp

Filesize
6.9MB

Download
memory/3468-383-0x000000007ED40000-0x000000007ED50000-memory.dmp

Filesize
64KB

Download
memory/3468-358-0x0000000008610000-0x000000000865B000-memory.dmp

Filesize
300KB

Download
memory/3468-356-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/3468-357-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/3468-389-0x0000000009590000-0x0000000009635000-memory.dmp

Filesize
660KB

Download
memory/4192-352-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4192-956-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4192-351-0x0000000002A90000-0x0000000002E91000-memory.dmp

Filesize
4.0MB

Download
memory/4192-434-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4192-1205-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4192-442-0x0000000002A90000-0x0000000002E91000-memory.dmp

Filesize
4.0MB

Download
memory/4288-2419-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-1238-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-2452-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-1733-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-2443-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-2430-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-2374-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4288-2425-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4360-2436-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4360-2423-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4476-2373-0x00007FF789DC0000-0x00007FF78A361000-memory.dmp

Filesize
5.6MB

Download
memory/4476-2405-0x00007FF789DC0000-0x00007FF78A361000-memory.dmp

Filesize
5.6MB

Download
memory/4476-1208-0x00007FF789DC0000-0x00007FF78A361000-memory.dmp

Filesize
5.6MB

Download
memory/4672-2445-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp

Filesize
7.9MB

Download
memory/4672-2427-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp

Filesize
7.9MB

Download
memory/4672-2432-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp

Filesize
7.9MB

Download
memory/4672-2406-0x0000000000D40000-0x0000000000D60000-memory.dmp

Filesize
128KB

Download
memory/4672-2455-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp

Filesize
7.9MB

Download
memory/4672-2422-0x00007FF626FA0000-0x00007FF62778F000-memory.dmp

Filesize
7.9MB

Download
memory/4848-115-0x000000000A080000-0x000000000A0B3000-memory.dmp

Filesize
204KB

Download
memory/4848-117-0x000000006F260000-0x000000006F5B0000-memory.dmp

Filesize
3.3MB

Download
memory/4848-324-0x0000000006F80000-0x0000000006F88000-memory.dmp

Filesize
32KB

Download
memory/4848-345-0x0000000073000000-0x00000000736EE000-memory.dmp

Filesize
6.9MB

Download
memory/4848-41-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/4848-42-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/4848-43-0x0000000007450000-0x0000000007A78000-memory.dmp

Filesize
6.2MB

Download
memory/4848-116-0x00000000711B0000-0x00000000711FB000-memory.dmp

Filesize
300KB

Download
memory/4848-44-0x0000000007360000-0x0000000007382000-memory.dmp

Filesize
136KB

Download
memory/4848-45-0x0000000007C60000-0x0000000007CC6000-memory.dmp

Filesize
408KB

Download
memory/4848-46-0x0000000007A80000-0x0000000007AE6000-memory.dmp

Filesize
408KB

Download
memory/4848-47-0x0000000007D50000-0x00000000080A0000-memory.dmp

Filesize
3.3MB

Download
memory/4848-39-0x0000000004930000-0x0000000004966000-memory.dmp

Filesize
216KB

Download
memory/4848-40-0x0000000073000000-0x00000000736EE000-memory.dmp

Filesize
6.9MB

Download
memory/4848-48-0x00000000080E0000-0x00000000080FC000-memory.dmp

Filesize
112KB

Download
memory/4848-118-0x000000000A060000-0x000000000A07E000-memory.dmp

Filesize
120KB

Download
memory/4848-114-0x000000007ECE0000-0x000000007ECF0000-memory.dmp

Filesize
64KB

Download
memory/4848-49-0x00000000083F0000-0x000000000843B000-memory.dmp

Filesize
300KB

Download
memory/4848-123-0x000000000A0C0000-0x000000000A165000-memory.dmp

Filesize
660KB

Download
memory/4848-125-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/4848-104-0x0000000009260000-0x00000000092D6000-memory.dmp

Filesize
472KB

Download
memory/4848-126-0x000000000A2E0000-0x000000000A374000-memory.dmp

Filesize
592KB

Download
memory/4848-73-0x00000000091A0000-0x00000000091DC000-memory.dmp

Filesize
240KB

Download
memory/4848-319-0x0000000006F90000-0x0000000006FAA000-memory.dmp

Filesize
104KB

Download
memory/4980-2418-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5080-29-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/5080-28-0x00000000009F0000-0x0000000000AF0000-memory.dmp

Filesize
1024KB

Download