Analysis
-
max time kernel
99s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 20:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231127-en
General
-
Target
file.exe
-
Size
289KB
-
MD5
3eb1c805bf87b43dbc5393c43fc806bf
-
SHA1
82fc4e16dbb009131b7ff0787c302d232b5915ae
-
SHA256
e89b094c70697e1c6780b135cca34184ce1d58d9a80e11175f1f4131bbf5fbf3
-
SHA512
337fdb0862c14e6c3695c7272cebf34334995471581076fd502000eb9e15dc6970a928d8f87c8da670aeabc00b43c536454611ae8855e2045c7eb807e1d0a1ed
-
SSDEEP
3072:uPyETEX3u3/0c6ATBIi0M22mT9YSnZkjRqMRw2RZapPwOeTsWL:+l4nM/ltTKi0MNE2RMpoT
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Signatures
-
Glupteba payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3480-104-0x0000000002D90000-0x000000000367B000-memory.dmp family_glupteba behavioral2/memory/3480-107-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3480-141-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3480-175-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1980-216-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1980-254-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-298-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-364-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-378-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-382-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-386-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3016-389-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
B572.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ B572.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
B572.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B572.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B572.exe -
Deletes itself 1 IoCs
Processes:
pid process 3172 -
Executes dropped EXE 8 IoCs
Processes:
AD34.exeB572.exeC206.exeCAA2.exeCAA2.execsrss.exedvccgbwwvccgbwpid process 408 AD34.exe 3948 B572.exe 3708 C206.exe 3480 CAA2.exe 1980 CAA2.exe 3016 csrss.exe 1772 dvccgbw 4740 wvccgbw -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4620 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\B572.exe themida C:\Users\Admin\AppData\Local\Temp\B572.exe themida behavioral2/memory/3948-48-0x0000000000040000-0x0000000000B80000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/1140-377-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2520-381-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2520-388-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CAA2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" CAA2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
B572.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B572.exe -
Drops file in System32 directory 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
B572.exepid process 3948 B572.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AD34.exedescription pid process target process PID 408 set thread context of 984 408 AD34.exe AppLaunch.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
CAA2.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN CAA2.exe -
Drops file in Windows directory 2 IoCs
Processes:
CAA2.exedescription ioc process File opened for modification C:\Windows\rss CAA2.exe File created C:\Windows\rss\csrss.exe CAA2.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4360 sc.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3616 408 WerFault.exe AD34.exe 4924 3480 WerFault.exe CAA2.exe 4064 1980 WerFault.exe CAA2.exe 3316 4740 WerFault.exe wvccgbw -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exeC206.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C206.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C206.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C206.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5016 schtasks.exe 2332 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
CAA2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" CAA2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" CAA2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" CAA2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 4544 file.exe 4544 file.exe 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3172 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
file.exeC206.exepid process 4544 file.exe 3172 3172 3172 3172 3708 C206.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
powershell.exeAppLaunch.exeB572.exeCAA2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 4032 powershell.exe Token: SeDebugPrivilege 984 AppLaunch.exe Token: SeDebugPrivilege 3948 B572.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 3480 CAA2.exe Token: SeImpersonatePrivilege 3480 CAA2.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 3616 powershell.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 4660 powershell.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 3924 powershell.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 5116 powershell.exe Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeDebugPrivilege 1116 powershell.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
regsvr32.exeAD34.exeCAA2.exeCAA2.execmd.execsrss.exedescription pid process target process PID 3172 wrote to memory of 1148 3172 regsvr32.exe PID 3172 wrote to memory of 1148 3172 regsvr32.exe PID 1148 wrote to memory of 4620 1148 regsvr32.exe regsvr32.exe PID 1148 wrote to memory of 4620 1148 regsvr32.exe regsvr32.exe PID 1148 wrote to memory of 4620 1148 regsvr32.exe regsvr32.exe PID 3172 wrote to memory of 408 3172 AD34.exe PID 3172 wrote to memory of 408 3172 AD34.exe PID 3172 wrote to memory of 408 3172 AD34.exe PID 3172 wrote to memory of 3948 3172 B572.exe PID 3172 wrote to memory of 3948 3172 B572.exe PID 3172 wrote to memory of 3948 3172 B572.exe PID 3172 wrote to memory of 3708 3172 C206.exe PID 3172 wrote to memory of 3708 3172 C206.exe PID 3172 wrote to memory of 3708 3172 C206.exe PID 408 wrote to memory of 3252 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 3252 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 3252 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 408 wrote to memory of 984 408 AD34.exe AppLaunch.exe PID 3172 wrote to memory of 3480 3172 CAA2.exe PID 3172 wrote to memory of 3480 3172 CAA2.exe PID 3172 wrote to memory of 3480 3172 CAA2.exe PID 3172 wrote to memory of 224 3172 explorer.exe PID 3172 wrote to memory of 224 3172 explorer.exe PID 3172 wrote to memory of 224 3172 explorer.exe PID 3172 wrote to memory of 224 3172 explorer.exe PID 3172 wrote to memory of 5000 3172 explorer.exe PID 3172 wrote to memory of 5000 3172 explorer.exe PID 3172 wrote to memory of 5000 3172 explorer.exe PID 3480 wrote to memory of 4032 3480 CAA2.exe powershell.exe PID 3480 wrote to memory of 4032 3480 CAA2.exe powershell.exe PID 3480 wrote to memory of 4032 3480 CAA2.exe powershell.exe PID 1980 wrote to memory of 3616 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 3616 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 3616 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 3860 1980 CAA2.exe cmd.exe PID 1980 wrote to memory of 3860 1980 CAA2.exe cmd.exe PID 3860 wrote to memory of 3280 3860 cmd.exe netsh.exe PID 3860 wrote to memory of 3280 3860 cmd.exe netsh.exe PID 1980 wrote to memory of 404 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 404 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 404 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 4660 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 4660 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 4660 1980 CAA2.exe powershell.exe PID 1980 wrote to memory of 3016 1980 CAA2.exe csrss.exe PID 1980 wrote to memory of 3016 1980 CAA2.exe csrss.exe PID 1980 wrote to memory of 3016 1980 CAA2.exe csrss.exe PID 3016 wrote to memory of 3924 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 3924 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 3924 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 5116 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 5116 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 5116 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 1116 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 1116 3016 csrss.exe powershell.exe PID 3016 wrote to memory of 1116 3016 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\AC48.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\AC48.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\AD34.exeC:\Users\Admin\AppData\Local\Temp\AD34.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 3042⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\B572.exeC:\Users\Admin\AppData\Local\Temp\B572.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C206.exeC:\Users\Admin\AppData\Local\Temp\C206.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 408 -ip 4081⤵
-
C:\Users\Admin\AppData\Local\Temp\CAA2.exeC:\Users\Admin\AppData\Local\Temp\CAA2.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CAA2.exe"C:\Users\Admin\AppData\Local\Temp\CAA2.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 6362⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3480 -ip 34801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1980 -ip 19801⤵
-
C:\Users\Admin\AppData\Roaming\dvccgbwC:\Users\Admin\AppData\Roaming\dvccgbw1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\wvccgbwC:\Users\Admin\AppData\Roaming\wvccgbw1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4740 -ip 47401⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AC48.dllFilesize
3.0MB
MD53a750b231ca7d49b77a2811578e223ac
SHA1dbf0520ff8919405d4ffaa620dfce2db63e56367
SHA256f75b0fc647b7f0a05d07ec3fe7b8880d6099074151e889108eff670a4dc675c2
SHA51205751db3d113250df57bcf99dae3fe2b04737adfd29384caf17002fcbd272aca85675fb33a25083315fb0f4f2c5524f6c425c3f42f1afc7eceda154aa54578d9
-
C:\Users\Admin\AppData\Local\Temp\AC48.dllFilesize
3.0MB
MD53a750b231ca7d49b77a2811578e223ac
SHA1dbf0520ff8919405d4ffaa620dfce2db63e56367
SHA256f75b0fc647b7f0a05d07ec3fe7b8880d6099074151e889108eff670a4dc675c2
SHA51205751db3d113250df57bcf99dae3fe2b04737adfd29384caf17002fcbd272aca85675fb33a25083315fb0f4f2c5524f6c425c3f42f1afc7eceda154aa54578d9
-
C:\Users\Admin\AppData\Local\Temp\AD34.exeFilesize
1.1MB
MD58d6db1c0be603e301e14d59ef24d7b06
SHA14d31f48256ed1320605284c119dffadd14dcc510
SHA256e6bc630ef036093b32773f92b3204391b31285dcd173f12ce2acb7830f812de2
SHA51253abdf54aabd735dfccd02045f47381136bd37b5bc1d7d6c8ec164b228b8b4d73c4847d2798619e9bae86e3317eee39b7bf40cea1fe4f31451fa4b2d8b2f22e2
-
C:\Users\Admin\AppData\Local\Temp\AD34.exeFilesize
1.1MB
MD58d6db1c0be603e301e14d59ef24d7b06
SHA14d31f48256ed1320605284c119dffadd14dcc510
SHA256e6bc630ef036093b32773f92b3204391b31285dcd173f12ce2acb7830f812de2
SHA51253abdf54aabd735dfccd02045f47381136bd37b5bc1d7d6c8ec164b228b8b4d73c4847d2798619e9bae86e3317eee39b7bf40cea1fe4f31451fa4b2d8b2f22e2
-
C:\Users\Admin\AppData\Local\Temp\B572.exeFilesize
4.6MB
MD518522f12bc42b23be611bd4d961d7bff
SHA16c37991adeb58df30b3476acddb97ac7152d2662
SHA256ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
SHA512019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
C:\Users\Admin\AppData\Local\Temp\B572.exeFilesize
4.6MB
MD518522f12bc42b23be611bd4d961d7bff
SHA16c37991adeb58df30b3476acddb97ac7152d2662
SHA256ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
SHA512019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
C:\Users\Admin\AppData\Local\Temp\C206.exeFilesize
288KB
MD5b5e126a7c8d6ba1817776235356983fa
SHA114a32d862f56a15182f389bd250747407da43cf2
SHA256866e1c9c4ff6f1a4d9f9ad07d68ccb9f0b55aa598832293a5e0cf63823d0f5fc
SHA5126a34cdb6601da1979143105adb91292c074bf6d8913b207210c0b69e7a79bca4b6fd0525f7038e1af5ea175c83131e88b72411ffea88bbf4238a21160115923f
-
C:\Users\Admin\AppData\Local\Temp\C206.exeFilesize
288KB
MD5b5e126a7c8d6ba1817776235356983fa
SHA114a32d862f56a15182f389bd250747407da43cf2
SHA256866e1c9c4ff6f1a4d9f9ad07d68ccb9f0b55aa598832293a5e0cf63823d0f5fc
SHA5126a34cdb6601da1979143105adb91292c074bf6d8913b207210c0b69e7a79bca4b6fd0525f7038e1af5ea175c83131e88b72411ffea88bbf4238a21160115923f
-
C:\Users\Admin\AppData\Local\Temp\CAA2.exeFilesize
4.2MB
MD5a6b262a10430f91d0ecffcfdd0d93ccb
SHA18d8820da03244650f30b4d87cd7e2997a832fabf
SHA256458577dcdead596647116d568a3933de141fe8581347fa2266707f790793de23
SHA5126da5d9e898c55de61da0df8acccf76654972f2dafaaa005164560ab862a6c18f479915a066339f893a7b64951975ac453ac8697af50d596bcb1e12cf74eb6061
-
C:\Users\Admin\AppData\Local\Temp\CAA2.exeFilesize
4.2MB
MD5a6b262a10430f91d0ecffcfdd0d93ccb
SHA18d8820da03244650f30b4d87cd7e2997a832fabf
SHA256458577dcdead596647116d568a3933de141fe8581347fa2266707f790793de23
SHA5126da5d9e898c55de61da0df8acccf76654972f2dafaaa005164560ab862a6c18f479915a066339f893a7b64951975ac453ac8697af50d596bcb1e12cf74eb6061
-
C:\Users\Admin\AppData\Local\Temp\CAA2.exeFilesize
4.2MB
MD5a6b262a10430f91d0ecffcfdd0d93ccb
SHA18d8820da03244650f30b4d87cd7e2997a832fabf
SHA256458577dcdead596647116d568a3933de141fe8581347fa2266707f790793de23
SHA5126da5d9e898c55de61da0df8acccf76654972f2dafaaa005164560ab862a6c18f479915a066339f893a7b64951975ac453ac8697af50d596bcb1e12cf74eb6061
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jq2rp0e3.mth.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Roaming\dvccgbwFilesize
289KB
MD53eb1c805bf87b43dbc5393c43fc806bf
SHA182fc4e16dbb009131b7ff0787c302d232b5915ae
SHA256e89b094c70697e1c6780b135cca34184ce1d58d9a80e11175f1f4131bbf5fbf3
SHA512337fdb0862c14e6c3695c7272cebf34334995471581076fd502000eb9e15dc6970a928d8f87c8da670aeabc00b43c536454611ae8855e2045c7eb807e1d0a1ed
-
C:\Users\Admin\AppData\Roaming\dvccgbwFilesize
289KB
MD53eb1c805bf87b43dbc5393c43fc806bf
SHA182fc4e16dbb009131b7ff0787c302d232b5915ae
SHA256e89b094c70697e1c6780b135cca34184ce1d58d9a80e11175f1f4131bbf5fbf3
SHA512337fdb0862c14e6c3695c7272cebf34334995471581076fd502000eb9e15dc6970a928d8f87c8da670aeabc00b43c536454611ae8855e2045c7eb807e1d0a1ed
-
C:\Users\Admin\AppData\Roaming\wvccgbwFilesize
288KB
MD5b5e126a7c8d6ba1817776235356983fa
SHA114a32d862f56a15182f389bd250747407da43cf2
SHA256866e1c9c4ff6f1a4d9f9ad07d68ccb9f0b55aa598832293a5e0cf63823d0f5fc
SHA5126a34cdb6601da1979143105adb91292c074bf6d8913b207210c0b69e7a79bca4b6fd0525f7038e1af5ea175c83131e88b72411ffea88bbf4238a21160115923f
-
C:\Users\Admin\AppData\Roaming\wvccgbwFilesize
288KB
MD5b5e126a7c8d6ba1817776235356983fa
SHA114a32d862f56a15182f389bd250747407da43cf2
SHA256866e1c9c4ff6f1a4d9f9ad07d68ccb9f0b55aa598832293a5e0cf63823d0f5fc
SHA5126a34cdb6601da1979143105adb91292c074bf6d8913b207210c0b69e7a79bca4b6fd0525f7038e1af5ea175c83131e88b72411ffea88bbf4238a21160115923f
-
C:\Users\Admin\AppData\Roaming\wvccgbwFilesize
288KB
MD5b5e126a7c8d6ba1817776235356983fa
SHA114a32d862f56a15182f389bd250747407da43cf2
SHA256866e1c9c4ff6f1a4d9f9ad07d68ccb9f0b55aa598832293a5e0cf63823d0f5fc
SHA5126a34cdb6601da1979143105adb91292c074bf6d8913b207210c0b69e7a79bca4b6fd0525f7038e1af5ea175c83131e88b72411ffea88bbf4238a21160115923f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD55f6e092f6f8721826b232bf4dea525d6
SHA1f277d0ebf7c8e313ec6d87b4aa13d3712c1def42
SHA256b78ef99090f94f6f270703e6be1b501766361b84f39d1d4b1c756bd590f2bec5
SHA51247ebd989d214cb96ee939f4b842dd9202f0f1083d1f31452769612fa920674b852b1b23f9af5f961c11d30d0b710edc710af4062ffb31eaf56213e8a159c8aed
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5934703b44448575f366818ba0d38706c
SHA153e435ee6a35c0b072fed524474d94ff73018a59
SHA25630b5d7a472227ae739da3cf80afbde8b6ff9d804484c16eaf8c1293dad6aaecc
SHA512b33b04a53d99cd8acbd08b7d5f34fe8028c70e6e02fad58c15be95a45661e51aae697a64ce6b4f1e95926caf87d72ca0aaf9c6a4edc718c3f2e91ad7250acc55
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5746b546eb28f3db48e696799236b6d2b
SHA17b1e3332e8a702bb5a79907d86f621f592c94313
SHA25637d124488e94087f2c7f01adaf9fe6cf3332a2d3c74bbf0414b080950997c091
SHA512f52254e7bbf9b00069de6e93fd0ce84fde40a7124824df0a91a2e5b37ecc26684de3d27dec6c7a62074342f11fbdbc7edea8b62851a429394d75f43464977dde
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54b42b1f7fccd4bc43f077cec56823b85
SHA1d24f09afd0d8c15f1240b0a9d7a852c9d1803394
SHA2562e9e446dee23ba17002125e42f71b08112c79eaf159fbe1316033e24c845ca52
SHA512f2006f8da8ee02d0221e7a03040fefcb7b19038e8c5fc70324f3f1100a32536bef08043d21c34bdb6da673aa35a538d58acbaa5cefbf6e3a17d844561a148a20
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54e9e431a8069db9b9f82258dd63f68b3
SHA18065e1431f380c13d8a4016378fbe2cd0f1c08ef
SHA2564430f3ac2d471ec22b6ceab1f75a615dfd14c28f319064c4d15d856d9917f9ae
SHA512747ae6b71b4b165ab6d1b4354be3ba7a6a95f987c946b202804063e7d287b44f7a24d0f7faad61ae4378f94ad1114bf857ee51c6b2c5d274ae8a5c50529c4105
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5a6b262a10430f91d0ecffcfdd0d93ccb
SHA18d8820da03244650f30b4d87cd7e2997a832fabf
SHA256458577dcdead596647116d568a3933de141fe8581347fa2266707f790793de23
SHA5126da5d9e898c55de61da0df8acccf76654972f2dafaaa005164560ab862a6c18f479915a066339f893a7b64951975ac453ac8697af50d596bcb1e12cf74eb6061
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5a6b262a10430f91d0ecffcfdd0d93ccb
SHA18d8820da03244650f30b4d87cd7e2997a832fabf
SHA256458577dcdead596647116d568a3933de141fe8581347fa2266707f790793de23
SHA5126da5d9e898c55de61da0df8acccf76654972f2dafaaa005164560ab862a6c18f479915a066339f893a7b64951975ac453ac8697af50d596bcb1e12cf74eb6061
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/224-110-0x00000000010C0000-0x000000000112B000-memory.dmpFilesize
428KB
-
memory/224-70-0x0000000001130000-0x00000000011A5000-memory.dmpFilesize
468KB
-
memory/224-73-0x00000000010C0000-0x000000000112B000-memory.dmpFilesize
428KB
-
memory/984-72-0x0000000005390000-0x000000000549A000-memory.dmpFilesize
1.0MB
-
memory/984-74-0x00000000052C0000-0x00000000052FC000-memory.dmpFilesize
240KB
-
memory/984-57-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/984-55-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/984-109-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/984-115-0x0000000006190000-0x0000000006206000-memory.dmpFilesize
472KB
-
memory/984-116-0x0000000006450000-0x000000000646E000-memory.dmpFilesize
120KB
-
memory/984-62-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/984-68-0x00000000057F0000-0x0000000005E08000-memory.dmpFilesize
6.1MB
-
memory/984-69-0x0000000005260000-0x0000000005272000-memory.dmpFilesize
72KB
-
memory/984-138-0x0000000007E30000-0x0000000007FF2000-memory.dmpFilesize
1.8MB
-
memory/984-140-0x0000000008530000-0x0000000008A5C000-memory.dmpFilesize
5.2MB
-
memory/984-142-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/984-145-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/984-79-0x0000000005300000-0x000000000534C000-memory.dmpFilesize
304KB
-
memory/1140-377-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1772-368-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/1980-216-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1980-254-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2520-388-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2520-381-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3016-382-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3016-386-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3016-364-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3016-298-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3016-389-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3016-378-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3172-111-0x00000000009E0000-0x00000000009F6000-memory.dmpFilesize
88KB
-
memory/3172-5-0x00000000029D0000-0x00000000029E6000-memory.dmpFilesize
88KB
-
memory/3172-365-0x00000000029F0000-0x0000000002A06000-memory.dmpFilesize
88KB
-
memory/3480-104-0x0000000002D90000-0x000000000367B000-memory.dmpFilesize
8.9MB
-
memory/3480-107-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3480-175-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3480-103-0x0000000002980000-0x0000000002D87000-memory.dmpFilesize
4.0MB
-
memory/3480-141-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3708-113-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/3708-58-0x00000000008B0000-0x00000000008BB000-memory.dmpFilesize
44KB
-
memory/3708-61-0x0000000000A90000-0x0000000000B90000-memory.dmpFilesize
1024KB
-
memory/3708-59-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/3948-37-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-34-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-31-0x0000000000040000-0x0000000000B80000-memory.dmpFilesize
11.2MB
-
memory/3948-32-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-137-0x0000000009880000-0x00000000098D0000-memory.dmpFilesize
320KB
-
memory/3948-105-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-108-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-35-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-106-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-38-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-36-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-102-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-39-0x0000000077CD4000-0x0000000077CD6000-memory.dmpFilesize
8KB
-
memory/3948-48-0x0000000000040000-0x0000000000B80000-memory.dmpFilesize
11.2MB
-
memory/3948-53-0x0000000008340000-0x00000000088E4000-memory.dmpFilesize
5.6MB
-
memory/3948-54-0x0000000007E30000-0x0000000007EC2000-memory.dmpFilesize
584KB
-
memory/3948-101-0x0000000000040000-0x0000000000B80000-memory.dmpFilesize
11.2MB
-
memory/3948-123-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-120-0x0000000077070000-0x0000000077160000-memory.dmpFilesize
960KB
-
memory/3948-66-0x0000000007DD0000-0x0000000007DDA000-memory.dmpFilesize
40KB
-
memory/4032-118-0x0000000002430000-0x0000000002466000-memory.dmpFilesize
216KB
-
memory/4032-122-0x0000000005200000-0x0000000005828000-memory.dmpFilesize
6.2MB
-
memory/4032-136-0x0000000005A20000-0x0000000005A3E000-memory.dmpFilesize
120KB
-
memory/4032-121-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4032-133-0x0000000005150000-0x0000000005172000-memory.dmpFilesize
136KB
-
memory/4032-149-0x0000000007300000-0x0000000007332000-memory.dmpFilesize
200KB
-
memory/4032-150-0x000000007EED0000-0x000000007EEE0000-memory.dmpFilesize
64KB
-
memory/4032-147-0x0000000007140000-0x000000000715A000-memory.dmpFilesize
104KB
-
memory/4032-134-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/4032-146-0x0000000007790000-0x0000000007E0A000-memory.dmpFilesize
6.5MB
-
memory/4032-119-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/4032-139-0x0000000006320000-0x0000000006364000-memory.dmpFilesize
272KB
-
memory/4032-143-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4032-135-0x0000000005AF0000-0x0000000005E44000-memory.dmpFilesize
3.3MB
-
memory/4544-7-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/4544-1-0x0000000000B60000-0x0000000000C60000-memory.dmpFilesize
1024KB
-
memory/4544-4-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/4544-3-0x0000000000400000-0x000000000086B000-memory.dmpFilesize
4.4MB
-
memory/4544-2-0x0000000000B10000-0x0000000000B1B000-memory.dmpFilesize
44KB
-
memory/4544-9-0x0000000000B10000-0x0000000000B1B000-memory.dmpFilesize
44KB
-
memory/4620-47-0x0000000002530000-0x0000000002643000-memory.dmpFilesize
1.1MB
-
memory/4620-24-0x0000000000300000-0x0000000000306000-memory.dmpFilesize
24KB
-
memory/4620-25-0x0000000010000000-0x00000000102FB000-memory.dmpFilesize
3.0MB
-
memory/4620-33-0x00000000023F0000-0x0000000002522000-memory.dmpFilesize
1.2MB
-
memory/4620-43-0x0000000002530000-0x0000000002643000-memory.dmpFilesize
1.1MB
-
memory/4620-46-0x0000000002530000-0x0000000002643000-memory.dmpFilesize
1.1MB
-
memory/5000-78-0x0000000000530000-0x000000000053C000-memory.dmpFilesize
48KB
-
memory/5000-76-0x0000000000540000-0x0000000000547000-memory.dmpFilesize
28KB
-
memory/5000-75-0x0000000000530000-0x000000000053C000-memory.dmpFilesize
48KB