Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2023 14:10
Static task
static1
General
-
Target
file.exe
-
Size
238KB
-
MD5
66b6c9a261d935b233d1f6934bffc239
-
SHA1
5b8681f9f431a96489863a16ae833b547f042780
-
SHA256
862b82e5905b93951a9f312e55b9470dd7e8f178ef481b56e06150a94ebbcb85
-
SHA512
9995d4cbec0da4012789451c9e16ac79b1869cde96f90d36dd01452c973232ee516397c4c788c5807551eb441f33cba7287cb3b46dc5855e590383e9d79152df
-
SSDEEP
3072:3a9fbArjVdpSXGaSBspv1H+oF95nNR9g8oGiWHqTCK:K9fbeVu2PBsp4o5Rg8BHqT
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Extracted
lumma
http://opposesicknessopw.pw/api
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\8A7D.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\8A7D.exe family_zgrat_v1 -
Glupteba payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4556-52-0x0000000002E00000-0x00000000036EB000-memory.dmp family_glupteba behavioral2/memory/4556-53-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4556-248-0x0000000002E00000-0x00000000036EB000-memory.dmp family_glupteba behavioral2/memory/4556-269-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4556-283-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4192-387-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2752-490-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2752-666-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2752-676-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2752-713-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2752-747-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
C4F6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C4F6.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
C4F6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C4F6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C4F6.exe -
Deletes itself 1 IoCs
Processes:
pid process 3344 -
Executes dropped EXE 19 IoCs
Processes:
C4F6.exeD591.exeDB10.exeE2B2.exeE2B2.tmpConhost.exeMaildelivery.exeDB10.execsrss.exeinjector.exe39CC.exe39CC.tmpDaisoLIB.exeDaisoLIB.exewindefender.exewindefender.exe8A7D.exe8EE3.exe933A.exepid process 4320 C4F6.exe 4152 D591.exe 4556 DB10.exe 1968 E2B2.exe 3232 E2B2.tmp 2256 Conhost.exe 4752 Maildelivery.exe 4192 DB10.exe 2752 csrss.exe 3548 injector.exe 1660 39CC.exe 2988 39CC.tmp 4876 DaisoLIB.exe 3044 DaisoLIB.exe 4288 windefender.exe 3544 windefender.exe 212 8A7D.exe 2720 8EE3.exe 3800 933A.exe -
Loads dropped DLL 8 IoCs
Processes:
E2B2.tmp39CC.tmp8A7D.exeregsvr32.exepid process 3232 E2B2.tmp 3232 E2B2.tmp 3232 E2B2.tmp 2988 39CC.tmp 2988 39CC.tmp 2988 39CC.tmp 212 8A7D.exe 3104 regsvr32.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\C4F6.exe themida C:\Users\Admin\AppData\Local\Temp\C4F6.exe themida behavioral2/memory/4320-29-0x0000000000A20000-0x0000000001560000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/4288-665-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3544-674-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3544-729-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DB10.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" DB10.exe Set value (str) \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
C4F6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C4F6.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
windefender.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive windefender.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log windefender.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive windefender.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
C4F6.exepid process 4320 C4F6.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
933A.exe8A7D.exedescription pid process target process PID 3800 set thread context of 1432 3800 933A.exe AppLaunch.exe PID 212 set thread context of 716 212 8A7D.exe RegSvcs.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
DB10.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN DB10.exe -
Drops file in Program Files directory 63 IoCs
Processes:
E2B2.tmpdescription ioc process File created C:\Program Files (x86)\Maildelivery\bin\x86\is-S2DHJ.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-56PGV.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-PFNQ7.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-105GS.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-FAJ84.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-1L06L.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-5V42S.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-E36R5.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-3JS4A.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-RHRBB.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-S2KKF.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-LGO86.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-QUK6J.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-OLTUK.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-0ISJD.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-PHE5Q.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-SO5M9.tmp E2B2.tmp File opened for modification C:\Program Files (x86)\Maildelivery\Maildelivery.exe E2B2.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-QJ85N.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-4PRMB.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-NGVD3.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\is-1LGUN.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-1AN6G.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-EHRCL.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-1NPF5.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-UP1OE.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-6CES8.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\is-GE03H.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EKDH0.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-RM0D1.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-SCI9V.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-NCGIE.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EG2G6.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-F790P.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EPKMI.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-JUL3B.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-J4HA6.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-GVP7J.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-UAROJ.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-V4LH1.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-093KO.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-C1OH3.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-9939B.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EI81R.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-O434M.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-JQN6E.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-L1Q7D.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-NUS44.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-GSD91.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-18896.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\lessmsi\is-RNEGK.tmp E2B2.tmp File opened for modification C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-67DF4.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-3MSP4.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-A19VM.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-J0P3Q.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-0J568.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-235BT.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-07B0G.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-7HDVN.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-5D6JC.tmp E2B2.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-C706B.tmp E2B2.tmp -
Drops file in Windows directory 4 IoCs
Processes:
DB10.execsrss.exedescription ioc process File opened for modification C:\Windows\rss DB10.exe File created C:\Windows\rss\csrss.exe DB10.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1564 sc.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3304 4556 WerFault.exe DB10.exe 4568 4192 WerFault.exe DB10.exe 1100 2720 WerFault.exe 8EE3.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
D591.exefile.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D591.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D591.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D591.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1640 schtasks.exe 4880 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exeDB10.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" DB10.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" DB10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates windefender.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 4960 file.exe 4960 file.exe 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 3344 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3344 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
file.exeD591.exepid process 4960 file.exe 4152 D591.exe 3344 3344 3344 3344 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeDB10.exewindefender.exepowershell.exepowershell.exewindefender.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 1192 powershell.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 4556 DB10.exe Token: SeImpersonatePrivilege 4556 DB10.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 3544 windefender.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 3880 powershell.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 1808 powershell.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 4288 windefender.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 1184 powershell.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeDebugPrivilege 1192 powershell.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeSystemEnvironmentPrivilege 2752 csrss.exe Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 Token: SeShutdownPrivilege 3344 Token: SeCreatePagefilePrivilege 3344 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3344 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
DB10.exeE2B2.exeE2B2.tmpnet.exeDB10.execmd.execsrss.exe39CC.exedescription pid process target process PID 3344 wrote to memory of 4320 3344 C4F6.exe PID 3344 wrote to memory of 4320 3344 C4F6.exe PID 3344 wrote to memory of 4320 3344 C4F6.exe PID 3344 wrote to memory of 4152 3344 D591.exe PID 3344 wrote to memory of 4152 3344 D591.exe PID 3344 wrote to memory of 4152 3344 D591.exe PID 3344 wrote to memory of 4556 3344 DB10.exe PID 3344 wrote to memory of 4556 3344 DB10.exe PID 3344 wrote to memory of 4556 3344 DB10.exe PID 4556 wrote to memory of 1192 4556 DB10.exe powershell.exe PID 4556 wrote to memory of 1192 4556 DB10.exe powershell.exe PID 4556 wrote to memory of 1192 4556 DB10.exe powershell.exe PID 3344 wrote to memory of 1968 3344 E2B2.exe PID 3344 wrote to memory of 1968 3344 E2B2.exe PID 3344 wrote to memory of 1968 3344 E2B2.exe PID 1968 wrote to memory of 3232 1968 E2B2.exe E2B2.tmp PID 1968 wrote to memory of 3232 1968 E2B2.exe E2B2.tmp PID 1968 wrote to memory of 3232 1968 E2B2.exe E2B2.tmp PID 3232 wrote to memory of 4708 3232 E2B2.tmp schtasks.exe PID 3232 wrote to memory of 4708 3232 E2B2.tmp schtasks.exe PID 3232 wrote to memory of 4708 3232 E2B2.tmp schtasks.exe PID 3232 wrote to memory of 2256 3232 E2B2.tmp Conhost.exe PID 3232 wrote to memory of 2256 3232 E2B2.tmp Conhost.exe PID 3232 wrote to memory of 2256 3232 E2B2.tmp Conhost.exe PID 3232 wrote to memory of 4944 3232 E2B2.tmp net.exe PID 3232 wrote to memory of 4944 3232 E2B2.tmp net.exe PID 3232 wrote to memory of 4944 3232 E2B2.tmp net.exe PID 3232 wrote to memory of 4752 3232 E2B2.tmp Maildelivery.exe PID 3232 wrote to memory of 4752 3232 E2B2.tmp Maildelivery.exe PID 3232 wrote to memory of 4752 3232 E2B2.tmp Maildelivery.exe PID 4944 wrote to memory of 4236 4944 net.exe net1.exe PID 4944 wrote to memory of 4236 4944 net.exe net1.exe PID 4944 wrote to memory of 4236 4944 net.exe net1.exe PID 4192 wrote to memory of 3544 4192 DB10.exe windefender.exe PID 4192 wrote to memory of 3544 4192 DB10.exe windefender.exe PID 4192 wrote to memory of 3544 4192 DB10.exe windefender.exe PID 4192 wrote to memory of 2216 4192 DB10.exe cmd.exe PID 4192 wrote to memory of 2216 4192 DB10.exe cmd.exe PID 2216 wrote to memory of 2540 2216 cmd.exe netsh.exe PID 2216 wrote to memory of 2540 2216 cmd.exe netsh.exe PID 4192 wrote to memory of 3880 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 3880 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 3880 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 1808 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 1808 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 1808 4192 DB10.exe powershell.exe PID 4192 wrote to memory of 2752 4192 DB10.exe csrss.exe PID 4192 wrote to memory of 2752 4192 DB10.exe csrss.exe PID 4192 wrote to memory of 2752 4192 DB10.exe csrss.exe PID 2752 wrote to memory of 4288 2752 csrss.exe windefender.exe PID 2752 wrote to memory of 4288 2752 csrss.exe windefender.exe PID 2752 wrote to memory of 4288 2752 csrss.exe windefender.exe PID 2752 wrote to memory of 1184 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 1184 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 1184 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 1192 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 1192 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 1192 2752 csrss.exe powershell.exe PID 2752 wrote to memory of 3548 2752 csrss.exe injector.exe PID 2752 wrote to memory of 3548 2752 csrss.exe injector.exe PID 3344 wrote to memory of 1660 3344 39CC.exe PID 3344 wrote to memory of 1660 3344 39CC.exe PID 3344 wrote to memory of 1660 3344 39CC.exe PID 1660 wrote to memory of 2988 1660 39CC.exe 39CC.tmp -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C4F6.exeC:\Users\Admin\AppData\Local\Temp\C4F6.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4320
-
C:\Users\Admin\AppData\Local\Temp\D591.exeC:\Users\Admin\AppData\Local\Temp\D591.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4152
-
C:\Users\Admin\AppData\Local\Temp\DB10.exeC:\Users\Admin\AppData\Local\Temp\DB10.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\DB10.exe"C:\Users\Admin\AppData\Local\Temp\DB10.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3544
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:4288
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4732
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
PID:3548 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1640 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4288 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:3976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 7483⤵
- Program crash
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 6962⤵
- Program crash
PID:3304
-
C:\Users\Admin\AppData\Local\Temp\E2B2.exeC:\Users\Admin\AppData\Local\Temp\E2B2.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\is-6PN6K.tmp\E2B2.tmp"C:\Users\Admin\AppData\Local\Temp\is-6PN6K.tmp\E2B2.tmp" /SL5="$C0092,7905477,54272,C:\Users\Admin\AppData\Local\Temp\E2B2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -i3⤵PID:2256
-
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -s3⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:4236
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4556 -ip 45561⤵PID:212
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4192 -ip 41921⤵PID:4452
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
PID:2256
-
C:\Users\Admin\AppData\Local\Temp\39CC.exeC:\Users\Admin\AppData\Local\Temp\39CC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\is-Q7NFH.tmp\39CC.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q7NFH.tmp\39CC.tmp" /SL5="$F00E0,7920261,54272,C:\Users\Admin\AppData\Local\Temp\39CC.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\is-BIGBS.tmp\DaisoLIB\DaisoLIB.exe"C:\Users\Admin\AppData\Local\Temp\is-BIGBS.tmp\DaisoLIB\DaisoLIB.exe" -s3⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\is-BIGBS.tmp\DaisoLIB\DaisoLIB.exe"C:\Users\Admin\AppData\Local\Temp\is-BIGBS.tmp\DaisoLIB\DaisoLIB.exe" -i1⤵
- Executes dropped EXE
PID:4876
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query1⤵PID:4800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 81⤵PID:3988
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
- Launches sc.exe
PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8A7D.exeC:\Users\Admin\AppData\Local\Temp\8A7D.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:212 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\8EE3.exeC:\Users\Admin\AppData\Local\Temp\8EE3.exe1⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 73002⤵
- Program crash
PID:1100
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"1⤵PID:1704
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"1⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\933A.exeC:\Users\Admin\AppData\Local\Temp\933A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3800
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D370.dll1⤵PID:4360
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\D370.dll2⤵
- Loads dropped DLL
PID:3104
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:536
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2720 -ip 27201⤵PID:4044
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
Filesize
128B
MD5785bb7f0b0cef59c39b9f5e21cd2fd04
SHA11e1ffdee1584a00bde18bd7bd19c02988301c250
SHA25690b35ec0c6b41acec2c9bb51cddcb6339fb035c222766a4ca4cbb15b7a7d8853
SHA5126d2449e111f7f059734960b83b0b090a7239ee2d93eb70f839ecddaa640658b90667f123cfb4fe8e0f5dc0a854a47b62aa2fcaf971d08b9118cac840dbf999eb
-
Filesize
8B
MD5427fcb8a85c404ebde58668b7fbe763d
SHA182a4bcab39933a272bf692928bc570b9149f6d89
SHA2568d3fe0ac09e2643fa38ef152ed326235b0b5727d9de0da3795d51d35fa951e2e
SHA512eb6a76a66927790571235e62f82f168fe9a30558e128b228fe1cee5a260845cca71cde3119e6fcaf2fcf8410039d37cf6616167c3f7340f0aa2095214757c0ee
-
Filesize
7.8MB
MD5b215f3726cc4ad0ee51479c703226921
SHA14ba2b845ec53115b9e9d1553377782becd749430
SHA256fc82ae779fe7fe22a71d9baca800a7318ee5bccc419b301916a24dcba9a93e70
SHA512a9667cb046c0530f216bf2116f7f93087f8ae2745f22654a9a486dfed3510496a403d3443a26d142252ef2ac9177b81115fd24127faa6092dc6173e2c369b27e
-
Filesize
7.8MB
MD5b215f3726cc4ad0ee51479c703226921
SHA14ba2b845ec53115b9e9d1553377782becd749430
SHA256fc82ae779fe7fe22a71d9baca800a7318ee5bccc419b301916a24dcba9a93e70
SHA512a9667cb046c0530f216bf2116f7f93087f8ae2745f22654a9a486dfed3510496a403d3443a26d142252ef2ac9177b81115fd24127faa6092dc6173e2c369b27e
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
Filesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
Filesize
4.6MB
MD518522f12bc42b23be611bd4d961d7bff
SHA16c37991adeb58df30b3476acddb97ac7152d2662
SHA256ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
SHA512019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
Filesize
4.6MB
MD518522f12bc42b23be611bd4d961d7bff
SHA16c37991adeb58df30b3476acddb97ac7152d2662
SHA256ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
SHA512019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
Filesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
Filesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
Filesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
Filesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
Filesize
7.8MB
MD55fb22300edef33e1f52a2dd3857b0d9b
SHA1fbb9ce3338923f0f7e6440fffc3489b0b4575150
SHA256d6eb736be434f88ae91f58eef3f861551a722560af326cb688b145ae32d3404d
SHA5121feaf351059a050e71ef8992bb569ccea42d32de086afe6e4a656f41dc924bb4bdb76cb3855313390cc3608e713d6de81f8a7a2a13530e4d14edb62c4b5cf6ff
-
Filesize
7.8MB
MD55fb22300edef33e1f52a2dd3857b0d9b
SHA1fbb9ce3338923f0f7e6440fffc3489b0b4575150
SHA256d6eb736be434f88ae91f58eef3f861551a722560af326cb688b145ae32d3404d
SHA5121feaf351059a050e71ef8992bb569ccea42d32de086afe6e4a656f41dc924bb4bdb76cb3855313390cc3608e713d6de81f8a7a2a13530e4d14edb62c4b5cf6ff
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
Filesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
Filesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
Filesize
110KB
MD5bdb65dce335ac29eccbc2ca7a7ad36b7
SHA1ce7678dcf7af0dbf9649b660db63db87325e6f69
SHA2567ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3
SHA5128aabca6be47a365acd28df8224f9b9b5e1654f67e825719286697fb9e1b75478dddf31671e3921f06632eed5bb3dda91d81e48d4550c2dcd8e2404d566f1bc29
-
Filesize
1KB
MD5992c00beab194ce392117bb419f53051
SHA18f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA2569e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d
-
Filesize
1KB
MD5257d1bf38fa7859ffc3717ef36577c04
SHA1a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD536dde09c2a5055f4441fcee54f163ea9
SHA1a11a93dd39c5fe3a8b5ec8bd1633488f26ad864b
SHA25697de0369d7ec3c5886e0a26a159dc702118e9c86248c5df4b0b87bd71e223357
SHA51256aa4d90f32d6a7fbfdfb3e7034a3ecdeaf5b6118b0823f93d6d20c6d0ed63e34d66ec4f77bc64a21d710bc56c7f0117d8140b49047f4049f1833fee5e515d39
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59ce22c740fe5b2dccd0aee1332f5f96b
SHA1344185fd5f93a73cb76a2601419ce5c6eb39f871
SHA256e8ba7ebeda409dcf5066ddd4400440841ef252290795432ed552a3afdb617ace
SHA5123d44810b820baae32b52db4c9935d90bd3b6e9acdf4135a62b6b13507c28640f11e8e59cf9357e689aecd330aa8058319f1d019ca349b810cbeadf300e0456c4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b2370437b7d88ce2e75f701bed5570ef
SHA1855422f283ca3524689cfafd8394d5b322aca07e
SHA2563e1585b95f51650f1f4e9c16895c7b8ea98bef0ed6b799d471422a59d0c1f1c2
SHA512ddbd5a76478d06769b64e90c44b0dae585bf2a1b3594098afadb99473f3cfa798fa705e962ea28a7c8d24fb5bb50dca099b04c77758cd56ddec0efa5abf6dc19
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e00ee3a9774bbeae9db8fc56cfdbec28
SHA1d226cd55adc6e5b75249c073c54224e4c2e2aacf
SHA2561d08302355cbe3f57f084f7e908ffc360023e9d8fbfb733c842caabf8eee7594
SHA51250aa1b7b33bea53034e5414bd5d42a6107f2143863fd9796bb88d11ffbe68cc598f719404f987a3852e5dfedcb700555e8b185f64f9bb1b658b2ae5aaa52c30d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD555230848b56c347a260db92dbe17ab6b
SHA1678648f6af9754fb44fe05e221672d549bb4589d
SHA256754a355cd72909d32aeab267c93aa6080ea77b204bb5c64d2200b4ca15c433be
SHA5124ae746318b2436bf9f92a6af0515cf24f353e3335f6c65e07b49ecea59ea23a80b0902b456c9dc9e55a2ced6dc551c413a3bbc3df644b5ff7267043219f39ddc
-
Filesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
Filesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec