Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2023 21:32
Static task
static1
Behavioral task
behavioral1
Sample
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe
Resource
win10v2004-20231201-en
General
-
Target
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe
-
Size
230KB
-
MD5
b4c3acf6d31b8210aa48a458addc03be
-
SHA1
637ae56d7d849b63186a97e1ba80eb37e47627f7
-
SHA256
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2
-
SHA512
efbfa3045bf7d2418709ad09825d32742aa29cb50bdb819a42124fc77d5f1683892dd5e37cd929573e9fd98ab17a08e74b4bca2e160ab2e592d5763eb5b8595b
-
SSDEEP
3072:0HpzzR7+kn7PHjrYcduxBdNMZvtRY+txTvsoGiWHCK:ezzRamjr1dux/0vM+txTkBH
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
57.128.155.22:20154
Extracted
lumma
http://opposesicknessopw.pw/api
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\BA18.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\BA18.exe family_zgrat_v1 behavioral1/memory/776-19-0x00000000002F0000-0x0000000000804000-memory.dmp family_zgrat_v1 -
Glupteba payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/4264-59-0x0000000002EF0000-0x00000000037DB000-memory.dmp family_glupteba behavioral1/memory/4264-60-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4264-412-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4264-422-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4264-484-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4264-499-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Raccoon Stealer V2 payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3540-31-0x00000000009A0000-0x00000000009B6000-memory.dmp family_raccoon_v2 behavioral1/memory/3540-32-0x0000000000400000-0x000000000085E000-memory.dmp family_raccoon_v2 behavioral1/memory/3540-66-0x0000000000400000-0x000000000085E000-memory.dmp family_raccoon_v2 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2864-452-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
542.exemi.exeupdater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 542.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mi.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe -
Blocklisted process makes network request 38 IoCs
Processes:
powershell.exeflow pid process 217 1856 powershell.exe 290 1856 powershell.exe 291 1856 powershell.exe 218 1856 powershell.exe 219 1856 powershell.exe 220 1856 powershell.exe 221 1856 powershell.exe 293 1856 powershell.exe 225 1856 powershell.exe 294 1856 powershell.exe 226 1856 powershell.exe 227 1856 powershell.exe 228 1856 powershell.exe 229 1856 powershell.exe 230 1856 powershell.exe 295 1856 powershell.exe 235 1856 powershell.exe 236 1856 powershell.exe 238 1856 powershell.exe 239 1856 powershell.exe 240 1856 powershell.exe 241 1856 powershell.exe 242 1856 powershell.exe 243 1856 powershell.exe 244 1856 powershell.exe 245 1856 powershell.exe 246 1856 powershell.exe 296 1856 powershell.exe 247 1856 powershell.exe 248 1856 powershell.exe 249 1856 powershell.exe 250 1856 powershell.exe 251 1856 powershell.exe 304 1856 powershell.exe 305 1856 powershell.exe 306 1856 powershell.exe 254 1856 powershell.exe 256 1856 powershell.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
mi.exeupdater.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts mi.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mi.exeupdater.exe542.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 542.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 542.exe -
Deletes itself 1 IoCs
Processes:
pid process 3392 -
Executes dropped EXE 21 IoCs
Processes:
BA18.exeBBBF.exeD7C5.exeDD64.exeE489.exeE489.tmpmdeliverylib.exemdeliverylib.exeFD03.exeFD03.tmpMaildelivery.exeMaildelivery.exe542.exe998.exeDD64.exemi.execsrss.exeinjector.exeupdater.exewindefender.exewindefender.exepid process 776 BA18.exe 3540 BBBF.exe 3120 D7C5.exe 4264 DD64.exe 884 E489.exe 1008 E489.tmp 2440 mdeliverylib.exe 3348 mdeliverylib.exe 4828 FD03.exe 3928 FD03.tmp 1432 Maildelivery.exe 2904 Maildelivery.exe 764 542.exe 3068 998.exe 3360 DD64.exe 4612 mi.exe 4156 csrss.exe 3420 injector.exe 1996 updater.exe 3584 windefender.exe 716 windefender.exe -
Loads dropped DLL 8 IoCs
Processes:
regsvr32.exeE489.tmpBA18.exeFD03.tmppid process 5116 regsvr32.exe 1008 E489.tmp 1008 E489.tmp 1008 E489.tmp 776 BA18.exe 3928 FD03.tmp 3928 FD03.tmp 3928 FD03.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\542.exe themida C:\Users\Admin\AppData\Local\Temp\542.exe themida behavioral1/memory/764-433-0x0000000000700000-0x0000000000F92000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida C:\ProgramData\Google\Chrome\updater.exe themida C:\ProgramData\Google\Chrome\updater.exe themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DD64.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" DD64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
542.exemi.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 542.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 11 IoCs
Processes:
powershell.exepowershell.exepowershell.exemi.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\system32\MRT.exe mi.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe updater.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
542.exemi.exeupdater.exepid process 764 542.exe 4612 mi.exe 1996 updater.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
BA18.exe998.exeupdater.exedescription pid process target process PID 776 set thread context of 1856 776 BA18.exe powershell.exe PID 3068 set thread context of 2864 3068 998.exe AppLaunch.exe PID 1996 set thread context of 3748 1996 updater.exe conhost.exe PID 1996 set thread context of 5004 1996 updater.exe explorer.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
DD64.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN DD64.exe -
Drops file in Program Files directory 64 IoCs
Processes:
FD03.tmpE489.tmpdescription ioc process File created C:\Program Files (x86)\Maildelivery\stuff\is-DR2QH.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-RSJ4R.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\lessmsi\is-7RAPU.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-1K2PI.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-PQ2I3.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-1IJCP.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-9E0PU.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-N391O.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-JS280.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\is-05V0F.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-8Q5QC.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-HDU3Q.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-MMEQB.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-FUH47.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-26ET7.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-DRIDC.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-BV3D6.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EM9M5.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-BG15Q.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-8VILM.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-A7UFI.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-SFJPT.tmp E489.tmp File opened for modification C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-AJNAK.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-HRKNI.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-K9QB9.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-HPJ4B.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-95M34.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-NO8VB.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-P8FEJ.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-27HUN.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-166P6.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-F3UFD.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-U9EIT.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-0KOBR.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\plugins\internal\is-1J2NQ.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-SILUJ.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-OHF5R.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-PE40Q.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-GQQGE.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\plugins\internal\is-N68U6.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-1Q3UV.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\uninstall\is-1263E.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-MF262.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-KN522.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-MAOUK.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-V44OD.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-PN7P1.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-HKKRV.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-SUH6T.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-DDRP2.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-TJEVP.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-IIJS3.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-PQ86P.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-4RA0K.tmp E489.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\lessmsi\is-V9V4D.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-7LQVL.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-54QGH.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-49PU3.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-OP9NJ.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-0N8S9.tmp FD03.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-4AOUL.tmp FD03.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-NES5P.tmp E489.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-MS1NJ.tmp FD03.tmp -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exeDD64.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss DD64.exe File created C:\Windows\rss\csrss.exe DD64.exe -
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4180 sc.exe 5100 sc.exe 3976 sc.exe 1744 sc.exe 3860 sc.exe 2308 sc.exe 4484 sc.exe 536 sc.exe 2968 sc.exe 4516 sc.exe 3736 sc.exe 3816 sc.exe 1736 sc.exe 5028 sc.exe 3028 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4540 3540 WerFault.exe BBBF.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exeD7C5.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D7C5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D7C5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D7C5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4684 schtasks.exe 1304 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exeDD64.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" DD64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" DD64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" DD64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" DD64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" DD64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" DD64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exepid process 1376 d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe 1376 d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 3392 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exeD7C5.exepid process 1376 d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe 3120 D7C5.exe 3392 3392 3392 3392 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
542.exeAppLaunch.exeConhost.exeDD64.exedescription pid process Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeDebugPrivilege 764 542.exe Token: SeDebugPrivilege 2864 AppLaunch.exe Token: SeDebugPrivilege 1900 Conhost.exe Token: SeShutdownPrivilege 3392 Token: SeCreatePagefilePrivilege 3392 Token: SeDebugPrivilege 4264 DD64.exe Token: SeImpersonatePrivilege 4264 DD64.exe Token: SeShutdownPrivilege 3392 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeE489.exeBA18.exeE489.tmpnet.exeFD03.exeFD03.tmpdescription pid process target process PID 3392 wrote to memory of 776 3392 BA18.exe PID 3392 wrote to memory of 776 3392 BA18.exe PID 3392 wrote to memory of 776 3392 BA18.exe PID 3392 wrote to memory of 3540 3392 BBBF.exe PID 3392 wrote to memory of 3540 3392 BBBF.exe PID 3392 wrote to memory of 3540 3392 BBBF.exe PID 3392 wrote to memory of 4344 3392 regsvr32.exe PID 3392 wrote to memory of 4344 3392 regsvr32.exe PID 4344 wrote to memory of 5116 4344 regsvr32.exe regsvr32.exe PID 4344 wrote to memory of 5116 4344 regsvr32.exe regsvr32.exe PID 4344 wrote to memory of 5116 4344 regsvr32.exe regsvr32.exe PID 3392 wrote to memory of 3120 3392 D7C5.exe PID 3392 wrote to memory of 3120 3392 D7C5.exe PID 3392 wrote to memory of 3120 3392 D7C5.exe PID 3392 wrote to memory of 4264 3392 DD64.exe PID 3392 wrote to memory of 4264 3392 DD64.exe PID 3392 wrote to memory of 4264 3392 DD64.exe PID 3392 wrote to memory of 884 3392 E489.exe PID 3392 wrote to memory of 884 3392 E489.exe PID 3392 wrote to memory of 884 3392 E489.exe PID 884 wrote to memory of 1008 884 E489.exe E489.tmp PID 884 wrote to memory of 1008 884 E489.exe E489.tmp PID 884 wrote to memory of 1008 884 E489.exe E489.tmp PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 776 wrote to memory of 1856 776 BA18.exe powershell.exe PID 1008 wrote to memory of 1992 1008 E489.tmp schtasks.exe PID 1008 wrote to memory of 1992 1008 E489.tmp schtasks.exe PID 1008 wrote to memory of 1992 1008 E489.tmp schtasks.exe PID 1008 wrote to memory of 2440 1008 E489.tmp mdeliverylib.exe PID 1008 wrote to memory of 2440 1008 E489.tmp mdeliverylib.exe PID 1008 wrote to memory of 2440 1008 E489.tmp mdeliverylib.exe PID 1008 wrote to memory of 3472 1008 E489.tmp net.exe PID 1008 wrote to memory of 3472 1008 E489.tmp net.exe PID 1008 wrote to memory of 3472 1008 E489.tmp net.exe PID 1008 wrote to memory of 3348 1008 E489.tmp mdeliverylib.exe PID 1008 wrote to memory of 3348 1008 E489.tmp mdeliverylib.exe PID 1008 wrote to memory of 3348 1008 E489.tmp mdeliverylib.exe PID 3472 wrote to memory of 2864 3472 net.exe AppLaunch.exe PID 3472 wrote to memory of 2864 3472 net.exe AppLaunch.exe PID 3472 wrote to memory of 2864 3472 net.exe AppLaunch.exe PID 3392 wrote to memory of 4828 3392 FD03.exe PID 3392 wrote to memory of 4828 3392 FD03.exe PID 3392 wrote to memory of 4828 3392 FD03.exe PID 4828 wrote to memory of 3928 4828 FD03.exe FD03.tmp PID 4828 wrote to memory of 3928 4828 FD03.exe FD03.tmp PID 4828 wrote to memory of 3928 4828 FD03.exe FD03.tmp PID 3928 wrote to memory of 3080 3928 FD03.tmp schtasks.exe PID 3928 wrote to memory of 3080 3928 FD03.tmp schtasks.exe PID 3928 wrote to memory of 3080 3928 FD03.tmp schtasks.exe PID 3928 wrote to memory of 1432 3928 FD03.tmp Maildelivery.exe PID 3928 wrote to memory of 1432 3928 FD03.tmp Maildelivery.exe PID 3928 wrote to memory of 1432 3928 FD03.tmp Maildelivery.exe PID 3928 wrote to memory of 4708 3928 FD03.tmp net.exe PID 3928 wrote to memory of 4708 3928 FD03.tmp net.exe PID 3928 wrote to memory of 4708 3928 FD03.tmp net.exe PID 3928 wrote to memory of 2904 3928 FD03.tmp Maildelivery.exe PID 3928 wrote to memory of 2904 3928 FD03.tmp Maildelivery.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe"C:\Users\Admin\AppData\Local\Temp\d5dbc8716577e805186355c42b87f825e6f37b7a2b35d27d07549077cb07cac2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1376
-
C:\Users\Admin\AppData\Local\Temp\BA18.exeC:\Users\Admin\AppData\Local\Temp\BA18.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BBBF.exeC:\Users\Admin\AppData\Local\Temp\BBBF.exe1⤵
- Executes dropped EXE
PID:3540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 73002⤵
- Program crash
PID:4540
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C759.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C759.dll2⤵
- Loads dropped DLL
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\D7C5.exeC:\Users\Admin\AppData\Local\Temp\D7C5.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3120
-
C:\Users\Admin\AppData\Local\Temp\DD64.exeC:\Users\Admin\AppData\Local\Temp\DD64.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\DD64.exe"C:\Users\Admin\AppData\Local\Temp\DD64.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3360 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1856 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:2592
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2412 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1716 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:4156 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3120 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4684 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1432
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1304 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
PID:3584 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:216
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:536
-
C:\Users\Admin\AppData\Local\Temp\E489.exeC:\Users\Admin\AppData\Local\Temp\E489.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\is-SE2UC.tmp\E489.tmp"C:\Users\Admin\AppData\Local\Temp\is-SE2UC.tmp\E489.tmp" /SL5="$70208,7932209,54272,C:\Users\Admin\AppData\Local\Temp\E489.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -i3⤵
- Executes dropped EXE
PID:2440 -
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -s3⤵
- Executes dropped EXE
PID:3348 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:2864
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\FD03.exeC:\Users\Admin\AppData\Local\Temp\FD03.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\is-6EG20.tmp\FD03.tmp"C:\Users\Admin\AppData\Local\Temp\is-6EG20.tmp\FD03.tmp" /SL5="$70228,7905477,54272,C:\Users\Admin\AppData\Local\Temp\FD03.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -i3⤵
- Executes dropped EXE
PID:1432 -
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -s3⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵PID:4708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:1740
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\542.exeC:\Users\Admin\AppData\Local\Temp\542.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:764
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3776
-
C:\Users\Admin\AppData\Local\Temp\998.exeC:\Users\Admin\AppData\Local\Temp\998.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\mi.exe"C:\Users\Admin\AppData\Local\Temp\mi.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4612 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵PID:448
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵PID:4464
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:1260
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:2968 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:5028 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:5100 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:2308 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:4484 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵PID:3836
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵PID:3020
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:1744 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵PID:4548
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵PID:4528
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
PID:4516 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:3028 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:3976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1072
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3540 -ip 35401⤵PID:3732
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:1996 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:644 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:1856
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3436
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3860 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3736 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3816 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4180 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1736 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵PID:2460
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵PID:3132
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵PID:3408
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵PID:4516
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:3748
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:5004
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:716
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
110KB
MD5bdb65dce335ac29eccbc2ca7a7ad36b7
SHA1ce7678dcf7af0dbf9649b660db63db87325e6f69
SHA2567ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3
SHA5128aabca6be47a365acd28df8224f9b9b5e1654f67e825719286697fb9e1b75478dddf31671e3921f06632eed5bb3dda91d81e48d4550c2dcd8e2404d566f1bc29
-
Filesize
1KB
MD5992c00beab194ce392117bb419f53051
SHA18f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA2569e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d
-
Filesize
1KB
MD5257d1bf38fa7859ffc3717ef36577c04
SHA1a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
128B
MD5785bb7f0b0cef59c39b9f5e21cd2fd04
SHA11e1ffdee1584a00bde18bd7bd19c02988301c250
SHA25690b35ec0c6b41acec2c9bb51cddcb6339fb035c222766a4ca4cbb15b7a7d8853
SHA5126d2449e111f7f059734960b83b0b090a7239ee2d93eb70f839ecddaa640658b90667f123cfb4fe8e0f5dc0a854a47b62aa2fcaf971d08b9118cac840dbf999eb
-
Filesize
8B
MD577dac2e50ae07f0c4a083cc2e5064735
SHA1749da744a84407b94756fa4a661ac15654b6f657
SHA256b3511e1dceae956603192fedbb6ab29904c6f2b04cf16b6d45c2ba45f7035037
SHA5123bb79c4242bca7f47f0e5c3d91e402e01d624c60b2b05d529c8c81752e380ae048e57d5952f29e98c7b9f4bd3b84222f50e552e874bb026830700058f5b54083
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
439KB
MD5b51bc8f85b7ba047b35022f505066b72
SHA14dd8e61f706c3057995a447d8f1c0c08f8ce6d9a
SHA256fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757
SHA5127b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd
-
Filesize
439KB
MD5b51bc8f85b7ba047b35022f505066b72
SHA14dd8e61f706c3057995a447d8f1c0c08f8ce6d9a
SHA256fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757
SHA5127b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
231KB
MD5bbdf62eb68339f5c1c1e16abc7fed17a
SHA10d81e7aec56f2fb0ce24cca21b93f490b5b52d92
SHA25655540d867b1ce54cffaaac585b043acd354158892d77b84321b9da3d753efdba
SHA5122d56111fa666c2d8c62890e203e20a823b0253eb39fbdbe281a77d273f2ee359f98ea587970682a2584c37169f2a69b489e9c0d05d674611fa76bdbf28f7e37a
-
Filesize
231KB
MD5bbdf62eb68339f5c1c1e16abc7fed17a
SHA10d81e7aec56f2fb0ce24cca21b93f490b5b52d92
SHA25655540d867b1ce54cffaaac585b043acd354158892d77b84321b9da3d753efdba
SHA5122d56111fa666c2d8c62890e203e20a823b0253eb39fbdbe281a77d273f2ee359f98ea587970682a2584c37169f2a69b489e9c0d05d674611fa76bdbf28f7e37a
-
Filesize
4.1MB
MD53b4aba6b45c9c6ecbe434d7849569707
SHA1b82a1f4b1c5e2f6032ffd0498639d6a45775bd97
SHA256b5386fc973abd142a5552d6ea6c628987e92410538cfcc2516c7ad66d6420dca
SHA5125cec18f496edc43727a0392f131fca181286bc0f7b213ba60334c3d522d4b128395007790a24f5dcc3a3b7d0f4c1135ff21887eeae593e1ad9dec95529b92372
-
Filesize
4.1MB
MD53b4aba6b45c9c6ecbe434d7849569707
SHA1b82a1f4b1c5e2f6032ffd0498639d6a45775bd97
SHA256b5386fc973abd142a5552d6ea6c628987e92410538cfcc2516c7ad66d6420dca
SHA5125cec18f496edc43727a0392f131fca181286bc0f7b213ba60334c3d522d4b128395007790a24f5dcc3a3b7d0f4c1135ff21887eeae593e1ad9dec95529b92372
-
Filesize
4.1MB
MD53b4aba6b45c9c6ecbe434d7849569707
SHA1b82a1f4b1c5e2f6032ffd0498639d6a45775bd97
SHA256b5386fc973abd142a5552d6ea6c628987e92410538cfcc2516c7ad66d6420dca
SHA5125cec18f496edc43727a0392f131fca181286bc0f7b213ba60334c3d522d4b128395007790a24f5dcc3a3b7d0f4c1135ff21887eeae593e1ad9dec95529b92372
-
Filesize
7.8MB
MD532d232abebaf6bfc9e761d1049dcb495
SHA112402ec6ab4610a8c9003ce2140b3e531f9d7261
SHA256a15247b4a88d66b695c5e130411a51eaef7f26687e754eeff9ad83a7728534dc
SHA5121917cf685dd04350f733b9a19933c400d86b38f7b700e64b3d2e077ca07e33d2de26dceba4dd441ae1174365be05c78cb327488a3bb21805a664a30ed6664bd9
-
Filesize
7.8MB
MD532d232abebaf6bfc9e761d1049dcb495
SHA112402ec6ab4610a8c9003ce2140b3e531f9d7261
SHA256a15247b4a88d66b695c5e130411a51eaef7f26687e754eeff9ad83a7728534dc
SHA5121917cf685dd04350f733b9a19933c400d86b38f7b700e64b3d2e077ca07e33d2de26dceba4dd441ae1174365be05c78cb327488a3bb21805a664a30ed6664bd9
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
231KB
MD5bbdf62eb68339f5c1c1e16abc7fed17a
SHA10d81e7aec56f2fb0ce24cca21b93f490b5b52d92
SHA25655540d867b1ce54cffaaac585b043acd354158892d77b84321b9da3d753efdba
SHA5122d56111fa666c2d8c62890e203e20a823b0253eb39fbdbe281a77d273f2ee359f98ea587970682a2584c37169f2a69b489e9c0d05d674611fa76bdbf28f7e37a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e749b0053777f25fb83657210009b275
SHA1341aa5928b100f65ab3bacdd9c1703015fa2de32
SHA25699f68120fa5316ea1fbc0f71fed993b3fbbef2050460551ec160df007b0dc592
SHA51277e3739f396cf8001465b3e428ca94852c2adeb9636271f7dcd14fef9c479387b86ef5f1b5f7f11d7909ac1ce07b1d7f2c3b145e1dda19e11c394868569effb0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e2d1d046af4a49b3a39724c943c30131
SHA1bfe7185a057f05a92e18130a5f95d5801e4fc95f
SHA2561273cc490bbaef305eaa0319e806f8853c7896595ab10434ff840d2012dd6330
SHA5124d096d3cac664e29f7444cb2e60e09a5cc126e464f5c34422187b0e70ae66646b31e9bdb5cbd7526107c4f02bf74eff56396e1d0719b0aa480426a7d5a39ef56
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ab12ec31f05c9efb5002795da7d4692f
SHA1ef79df6e8902f1b98de727b5e90db6093e0d6860
SHA256dfdc80eed081f73b6f39550e58d0d39338ae44e68cf8aecc4e4ba87143d2c8b7
SHA512908d1ca5fd99c63466ab7131b75753cb9582b14c34d678b471450d21af41a2eea03c466a0a7147dc53929a480fa2ebc6c47853c3b930af36e83990498a69b107
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD538840d0e79a8b4fa59cb8aacf73de3a0
SHA1f81b6fd764c04fbd60313c04e8fb4c571e10728b
SHA256164ef7c72165881ee55b7816a2664c0f837683e96af6393661fae59dad558ed9
SHA51216d8f2c1449edd0b2e0f35b762ac3f19a8246f3191c62fa8d1b5fdb4adb1cbbe96c9ca7af0e9efbb5457f163f4958a414f1a880c6ae4ff4e29a0ecad7b3ede83
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD542439a04d9f068e1b698738666672285
SHA160a257bd33c5d7b85b2783da095750b5891a7ab3
SHA2564953a522806d0d2355969cf83bd50b227b9306ceaa21ee59047f26b46a2d222d
SHA5121ce234ab11a63c136d97266b02bc7e38d63d08c50ba89356a12aa14dd197d1d9d2f2503bdcfeb5e211e40902d6616701898a84b1e1cf46d5ef8c9d15ad84469c
-
Filesize
4.1MB
MD53b4aba6b45c9c6ecbe434d7849569707
SHA1b82a1f4b1c5e2f6032ffd0498639d6a45775bd97
SHA256b5386fc973abd142a5552d6ea6c628987e92410538cfcc2516c7ad66d6420dca
SHA5125cec18f496edc43727a0392f131fca181286bc0f7b213ba60334c3d522d4b128395007790a24f5dcc3a3b7d0f4c1135ff21887eeae593e1ad9dec95529b92372
-
Filesize
4.1MB
MD53b4aba6b45c9c6ecbe434d7849569707
SHA1b82a1f4b1c5e2f6032ffd0498639d6a45775bd97
SHA256b5386fc973abd142a5552d6ea6c628987e92410538cfcc2516c7ad66d6420dca
SHA5125cec18f496edc43727a0392f131fca181286bc0f7b213ba60334c3d522d4b128395007790a24f5dcc3a3b7d0f4c1135ff21887eeae593e1ad9dec95529b92372
-
Filesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec