glupteba | c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-1703_x64
resource
win10-20231129-en
resource tags

arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
submitted
08-12-2023 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
Size

238KB
MD5

53f09ec546fa2d3b1ae9f98e414958ea
SHA1

217f2a9a31db0efdc64ebacb71070ae045441e82
SHA256

c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6
SHA512

60cf7f755fdd8e1cbc7b010cb46d050f0dc6bbcb0d888855e402bdbc5dc08f39e63bcaefe257724fc9aeb516b6a4341949193c4ca3492382946861e8fbde73a6
SSDEEP

3072:Pk52Zrarv8RJXwSRjdfsVCLT8X6PneUb+aIRPnfoGiWHqTCK:2GQ+61IvO6DefBHqT

Malware Config

Extracted

Family

smokeloader

Version

2022

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

http://humydrole.com/tmp/index.php

http://trunk-co.ru/tmp/index.php

http://weareelight.com/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

http://opposesicknessopw.pw/api

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\39E8.exe	family_zgrat_v1
behavioral1/memory/3448-44-0x0000000000600000-0x0000000000B14000-memory.dmp	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\39E8.exe	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4696-426-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral1/memory/4696-427-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4696-478-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4696-604-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4696-868-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/768-54-0x0000000000990000-0x00000000009A6000-memory.dmp	family_raccoon_v2
behavioral1/memory/768-55-0x0000000000400000-0x000000000085E000-memory.dmp	family_raccoon_v2

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

65EF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\65EF.exe = "0"	65EF.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

24D9.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 24D9.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2340 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	24D9.exe

pid	process
2340	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

24D9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	24D9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	24D9.exe

Deletes itself 1 IoCs

Processes:

pid process

2888

pid	process
2888

Executes dropped EXE 15 IoCs

Processes:

24D9.exe39E8.exe3B7F.exe3DA3.exe5ECA.exe65EF.exe71F6.exe71F6.tmp8E39.exe8E39.tmp65EF.execsrss.exeinjector.exewindefender.exewindefender.exe

pid	process
1052	24D9.exe
3448	39E8.exe
768	3B7F.exe
4736	3DA3.exe
4628	5ECA.exe
4696	65EF.exe
4676	71F6.exe
1312	71F6.tmp
1380	8E39.exe
2424	8E39.tmp
3444	65EF.exe
2660	csrss.exe
3184	injector.exe
4204	windefender.exe
4364	windefender.exe

Loads dropped DLL 8 IoCs

Processes:

regsvr32.exe39E8.exe71F6.tmp8E39.tmp

pid process

4608 regsvr32.exe
3448 39E8.exe
1312 71F6.tmp
1312 71F6.tmp
1312 71F6.tmp
2424 8E39.tmp
2424 8E39.tmp
2424 8E39.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4608	regsvr32.exe
3448	39E8.exe
1312	71F6.tmp
1312	71F6.tmp
1312	71F6.tmp
2424	8E39.tmp
2424	8E39.tmp
2424	8E39.tmp

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\24D9.exe	themida
C:\Users\Admin\AppData\Local\Temp\24D9.exe	themida
behavioral1/memory/1052-31-0x0000000001220000-0x0000000001D60000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

65EF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	65EF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\65EF.exe = "0"	65EF.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

65EF.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	65EF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

24D9.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 24D9.exe
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	24D9.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

24D9.exe

pid process

1052 24D9.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3DA3.exe39E8.exe

description	pid	process	target process
PID 4736 set thread context of 656	4736	3DA3.exe	AppLaunch.exe
PID 3448 set thread context of 1872	3448	39E8.exe	RegSvcs.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

65EF.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 65EF.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	65EF.exe

Drops file in Program Files directory 9 IoCs

Processes:

71F6.tmp8E39.tmp

description	ioc	process
File created	C:\Program Files (x86)\Maildelivery\uninstall\is-VFTC6.tmp	71F6.tmp
File created	C:\Program Files (x86)\Maildelivery\stuff\is-58KK7.tmp	71F6.tmp
File created	C:\Program Files (x86)\Maildelivery\stuff\is-SIO70.tmp	8E39.tmp
File created	C:\Program Files (x86)\Maildelivery\stuff\is-GC98S.tmp	8E39.tmp
File created	C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat	71F6.tmp
File created	C:\Program Files (x86)\Maildelivery\stuff\is-0SAAL.tmp	71F6.tmp
File created	C:\Program Files (x86)\Maildelivery\stuff\is-NJ527.tmp	71F6.tmp
File created	C:\Program Files (x86)\Maildelivery\uninstall\unins001.dat	8E39.tmp
File created	C:\Program Files (x86)\Maildelivery\uninstall\is-P99UG.tmp	8E39.tmp

Drops file in Windows directory 4 IoCs

Processes:

65EF.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	65EF.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	65EF.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2940 sc.exe

pid	process
2940	sc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe5ECA.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5ECA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5ECA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5ECA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3392 schtasks.exe
4656 schtasks.exe

pid	process
3392	schtasks.exe
4656	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

65EF.exepowershell.exepowershell.exepowershell.exewindefender.execsrss.exepowershell.exenetsh.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	65EF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	65EF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	65EF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe

pid	process
4216	c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
4216	c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888
2888

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2888
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe5ECA.exe

pid process

4216 c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
4628 5ECA.exe
2888
2888
2888
2888

pid	process
2888

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

AppLaunch.exe24D9.exepowershell.exe65EF.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	656	AppLaunch.exe
Token: SeDebugPrivilege	1052	24D9.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	4696	65EF.exe
Token: SeImpersonatePrivilege	4696	65EF.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeSystemEnvironmentPrivilege	2660	csrss.exe
Token: SeShutdownPrivilege	2888
Token: SeCreatePagefilePrivilege	2888
Token: SeSecurityPrivilege	2940	sc.exe
Token: SeSecurityPrivilege	2940	sc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

2888
2888
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

2888
2888

pid	process
2888
2888

pid	process
2888
2888

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3DA3.exeregsvr32.exe39E8.exe71F6.exe8E39.exe65EF.exe65EF.exe

description	pid	process	target process
PID 2888 wrote to memory of 1052	2888		24D9.exe
PID 2888 wrote to memory of 1052	2888		24D9.exe
PID 2888 wrote to memory of 1052	2888		24D9.exe
PID 2888 wrote to memory of 3448	2888		39E8.exe
PID 2888 wrote to memory of 3448	2888		39E8.exe
PID 2888 wrote to memory of 3448	2888		39E8.exe
PID 2888 wrote to memory of 768	2888		3B7F.exe
PID 2888 wrote to memory of 768	2888		3B7F.exe
PID 2888 wrote to memory of 768	2888		3B7F.exe
PID 2888 wrote to memory of 4736	2888		3DA3.exe
PID 2888 wrote to memory of 4736	2888		3DA3.exe
PID 2888 wrote to memory of 4736	2888		3DA3.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 4736 wrote to memory of 656	4736	3DA3.exe	AppLaunch.exe
PID 2888 wrote to memory of 760	2888		regsvr32.exe
PID 2888 wrote to memory of 760	2888		regsvr32.exe
PID 760 wrote to memory of 4608	760	regsvr32.exe	regsvr32.exe
PID 760 wrote to memory of 4608	760	regsvr32.exe	regsvr32.exe
PID 760 wrote to memory of 4608	760	regsvr32.exe	regsvr32.exe
PID 2888 wrote to memory of 4628	2888		5ECA.exe
PID 2888 wrote to memory of 4628	2888		5ECA.exe
PID 2888 wrote to memory of 4628	2888		5ECA.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 3448 wrote to memory of 1872	3448	39E8.exe	RegSvcs.exe
PID 2888 wrote to memory of 4696	2888		65EF.exe
PID 2888 wrote to memory of 4696	2888		65EF.exe
PID 2888 wrote to memory of 4696	2888		65EF.exe
PID 2888 wrote to memory of 4676	2888		71F6.exe
PID 2888 wrote to memory of 4676	2888		71F6.exe
PID 2888 wrote to memory of 4676	2888		71F6.exe
PID 4676 wrote to memory of 1312	4676	71F6.exe	71F6.tmp
PID 4676 wrote to memory of 1312	4676	71F6.exe	71F6.tmp
PID 4676 wrote to memory of 1312	4676	71F6.exe	71F6.tmp
PID 2888 wrote to memory of 1380	2888		8E39.exe
PID 2888 wrote to memory of 1380	2888		8E39.exe
PID 2888 wrote to memory of 1380	2888		8E39.exe
PID 1380 wrote to memory of 2424	1380	8E39.exe	8E39.tmp
PID 1380 wrote to memory of 2424	1380	8E39.exe	8E39.tmp
PID 1380 wrote to memory of 2424	1380	8E39.exe	8E39.tmp
PID 2888 wrote to memory of 896	2888		explorer.exe
PID 2888 wrote to memory of 896	2888		explorer.exe
PID 2888 wrote to memory of 896	2888		explorer.exe
PID 2888 wrote to memory of 896	2888		explorer.exe
PID 2888 wrote to memory of 3216	2888		explorer.exe
PID 2888 wrote to memory of 3216	2888		explorer.exe
PID 2888 wrote to memory of 3216	2888		explorer.exe
PID 4696 wrote to memory of 4636	4696	65EF.exe	powershell.exe
PID 4696 wrote to memory of 4636	4696	65EF.exe	powershell.exe
PID 4696 wrote to memory of 4636	4696	65EF.exe	powershell.exe
PID 3444 wrote to memory of 4424	3444	65EF.exe	powershell.exe
PID 3444 wrote to memory of 4424	3444	65EF.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe
"C:\Users\Admin\AppData\Local\Temp\c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4216

C:\Users\Admin\AppData\Local\Temp\24D9.exe
C:\Users\Admin\AppData\Local\Temp\24D9.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Users\Admin\AppData\Local\Temp\39E8.exe
C:\Users\Admin\AppData\Local\Temp\39E8.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
2⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\3B7F.exe
C:\Users\Admin\AppData\Local\Temp\3B7F.exe
1⤵
- Executes dropped EXE
PID:768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:656

C:\Users\Admin\AppData\Local\Temp\3DA3.exe
C:\Users\Admin\AppData\Local\Temp\3DA3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4CA8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4CA8.dll
2⤵
- Loads dropped DLL
PID:4608

C:\Users\Admin\AppData\Local\Temp\5ECA.exe
C:\Users\Admin\AppData\Local\Temp\5ECA.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4628

C:\Users\Admin\AppData\Local\Temp\65EF.exe
C:\Users\Admin\AppData\Local\Temp\65EF.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Users\Admin\AppData\Local\Temp\65EF.exe
"C:\Users\Admin\AppData\Local\Temp\65EF.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:4128

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3392

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
PID:3184

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4656

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
PID:4204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:2248

C:\Users\Admin\AppData\Local\Temp\71F6.exe
C:\Users\Admin\AppData\Local\Temp\71F6.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676

C:\Users\Admin\AppData\Local\Temp\is-P5TEJ.tmp\71F6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-P5TEJ.tmp\71F6.tmp" /SL5="$C007A,7905477,54272,C:\Users\Admin\AppData\Local\Temp\71F6.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1312

C:\Users\Admin\AppData\Local\Temp\8E39.exe
C:\Users\Admin\AppData\Local\Temp\8E39.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\is-JBTEF.tmp\8E39.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JBTEF.tmp\8E39.tmp" /SL5="$40236,7905477,54272,C:\Users\Admin\AppData\Local\Temp\8E39.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2424

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:896

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3216

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Maildelivery\stuff\is-GC98S.tmp

Filesize
1KB

MD5
257d1bf38fa7859ffc3717ef36577c04

SHA1
a9d2606cfc35e17108d7c079a355a4db54c7c2ee

SHA256
dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb

SHA512
e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3

Download Submit
C:\Program Files (x86)\Maildelivery\stuff\tagsreplace.txt

Filesize
1KB

MD5
992c00beab194ce392117bb419f53051

SHA1
8f9114c95e2a2c9f9c65b9243d941dcb5cea40de

SHA256
9e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c

SHA512
facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\24D9.exe

Filesize
4.6MB

MD5
18522f12bc42b23be611bd4d961d7bff

SHA1
6c37991adeb58df30b3476acddb97ac7152d2662

SHA256
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd

SHA512
019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\24D9.exe

Filesize
4.6MB

MD5
18522f12bc42b23be611bd4d961d7bff

SHA1
6c37991adeb58df30b3476acddb97ac7152d2662

SHA256
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd

SHA512
019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\39E8.exe

Filesize
5.1MB

MD5
7f4f98a26d4835578f46224112cc6a15

SHA1
c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0

SHA256
c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276

SHA512
c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\39E8.exe

Filesize
5.1MB

MD5
7f4f98a26d4835578f46224112cc6a15

SHA1
c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0

SHA256
c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276

SHA512
c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B7F.exe

Filesize
237KB

MD5
22a51b329fa194d51f68705a25d7396d

SHA1
aada03d8b7f1e28dbf6d72c1503981ccc5bb94da

SHA256
82857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742

SHA512
0d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B7F.exe

Filesize
237KB

MD5
22a51b329fa194d51f68705a25d7396d

SHA1
aada03d8b7f1e28dbf6d72c1503981ccc5bb94da

SHA256
82857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742

SHA512
0d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DA3.exe

Filesize
382KB

MD5
d8aff64273bcd3ef2208d6c4b0214d24

SHA1
593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1

SHA256
a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283

SHA512
bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DA3.exe

Filesize
382KB

MD5
d8aff64273bcd3ef2208d6c4b0214d24

SHA1
593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1

SHA256
a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283

SHA512
bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4CA8.dll

Filesize
4.1MB

MD5
184fc62aeb4c9d78891eb8d509c429e5

SHA1
4456d00e767b918a5118741985f2e1bc924b8e53

SHA256
6b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052

SHA512
100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ECA.exe

Filesize
238KB

MD5
6aa812025d813a1256b2f4ab1cf3b9f6

SHA1
db286a8c39a5da3d647d0e651b26c09c46ce61f3

SHA256
4c78c84341640500ffb7af6bdc1011d384ba74c6157fbc8bd8661995f06a9bf4

SHA512
f07eafc350b6911cbd9923ceb014732c6c38ea8644e72221298598da21339980a67a2c093de1e5dd5f82365b88cbb67e0c29dee3f804145a013d024c371e3fd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ECA.exe

Filesize
238KB

MD5
6aa812025d813a1256b2f4ab1cf3b9f6

SHA1
db286a8c39a5da3d647d0e651b26c09c46ce61f3

SHA256
4c78c84341640500ffb7af6bdc1011d384ba74c6157fbc8bd8661995f06a9bf4

SHA512
f07eafc350b6911cbd9923ceb014732c6c38ea8644e72221298598da21339980a67a2c093de1e5dd5f82365b88cbb67e0c29dee3f804145a013d024c371e3fd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\65EF.exe

Filesize
4.1MB

MD5
094cf6ba801fd508f177fd15fa16e9e0

SHA1
99f3905b06c9ec1f69fce1e2001f2066d0530365

SHA256
8a2b78fab2feb693ded5911101e6191dfa29debcd06643507c7e04e5c6c2b4ab

SHA512
cddf4375d52289dab51a318fcc93ebcb7c1de4087cdcf7d6e0f218412ced6dd47256be0aa609a353db30fa022af152e2fb0c4fb9dc21bfc2d5f6c045d30ea8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\65EF.exe

Filesize
4.1MB

MD5
094cf6ba801fd508f177fd15fa16e9e0

SHA1
99f3905b06c9ec1f69fce1e2001f2066d0530365

SHA256
8a2b78fab2feb693ded5911101e6191dfa29debcd06643507c7e04e5c6c2b4ab

SHA512
cddf4375d52289dab51a318fcc93ebcb7c1de4087cdcf7d6e0f218412ced6dd47256be0aa609a353db30fa022af152e2fb0c4fb9dc21bfc2d5f6c045d30ea8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\65EF.exe

Filesize
4.1MB

MD5
094cf6ba801fd508f177fd15fa16e9e0

SHA1
99f3905b06c9ec1f69fce1e2001f2066d0530365

SHA256
8a2b78fab2feb693ded5911101e6191dfa29debcd06643507c7e04e5c6c2b4ab

SHA512
cddf4375d52289dab51a318fcc93ebcb7c1de4087cdcf7d6e0f218412ced6dd47256be0aa609a353db30fa022af152e2fb0c4fb9dc21bfc2d5f6c045d30ea8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\71F6.exe

Filesize
7.8MB

MD5
e1b2d33aabd4574989f300d1dbd28e91

SHA1
1150d0892179faeb5eef4de992c6da7cf7d8f436

SHA256
0ae099582c67b291dd57b0351e2a59909f87c0c39d262a768ca476313948bdd2

SHA512
3b3f7f17b9da33eac485b557bfded7c4949060c5146fe23db064fb5be49ca65f53256e960386e114399b1923cdd96ff7eccde8bcde93c7c5abc088227133a622

Download Submit
C:\Users\Admin\AppData\Local\Temp\71F6.exe

Filesize
7.8MB

MD5
e1b2d33aabd4574989f300d1dbd28e91

SHA1
1150d0892179faeb5eef4de992c6da7cf7d8f436

SHA256
0ae099582c67b291dd57b0351e2a59909f87c0c39d262a768ca476313948bdd2

SHA512
3b3f7f17b9da33eac485b557bfded7c4949060c5146fe23db064fb5be49ca65f53256e960386e114399b1923cdd96ff7eccde8bcde93c7c5abc088227133a622

Download Submit
C:\Users\Admin\AppData\Local\Temp\8E39.exe

Filesize
7.8MB

MD5
8e4ababd8277cb8fd39a6866789d6a33

SHA1
145d8720b4c49948bf679d3baf47a738252ece62

SHA256
8d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71

SHA512
7d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8E39.exe

Filesize
7.8MB

MD5
8e4ababd8277cb8fd39a6866789d6a33

SHA1
145d8720b4c49948bf679d3baf47a738252ece62

SHA256
8d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71

SHA512
7d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hg5hdiag.adi.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JBTEF.tmp\8E39.tmp

Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JBTEF.tmp\8E39.tmp

Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5TEJ.tmp\71F6.tmp

Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5TEJ.tmp\71F6.tmp

Filesize
694KB

MD5
5525670a9e72d77b368a9aa4b8c814c1

SHA1
3fdad952ea00175f3a6e549b5dca4f568e394612

SHA256
1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

SHA512
757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Roaming\vbavdij

Filesize
238KB

MD5
6aa812025d813a1256b2f4ab1cf3b9f6

SHA1
db286a8c39a5da3d647d0e651b26c09c46ce61f3

SHA256
4c78c84341640500ffb7af6bdc1011d384ba74c6157fbc8bd8661995f06a9bf4

SHA512
f07eafc350b6911cbd9923ceb014732c6c38ea8644e72221298598da21339980a67a2c093de1e5dd5f82365b88cbb67e0c29dee3f804145a013d024c371e3fd6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f9d1a773dec6bc9b13b914f929ddddca

SHA1
1cfe5911e1bbb50b64453e0ea43d5f59f5f0c897

SHA256
4a97073f9f92284432920388abbff9ed717bec897baaa21b43d78521beb9ae6a

SHA512
0cbe40f2ff7320f6dd404899f17203fc04a5411b26605e77b24608386abeadb1b24e56e1d505c766b35db50dbb0e8ac2cdb260fe8914d698a130290adb948df9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
1849146c767a9f409844308a613c17c1

SHA1
662eb4bcae7c1f679e717f0fee15cb4367b300fb

SHA256
d043f5e7d7edefaccfcbfd2458631fa2ea114ea504d09193bf6d947d8b66d67a

SHA512
a938c5b06c7aa21f4a098a771661d53a7c4152e4aeb95bbbf09277488294611368fe04b49635b330dfb804069dfdbd3325599e605d48c9a4853d89c2c2a1ab4d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
a743176ca2792f5a3e2f19f53e336c99

SHA1
074ec1e7fd195b4400b5c581ae564157837d300a

SHA256
514cbbb8cd64c5cdcbf3030db23e7d8b085d681475d8d99eefded0b394625fab

SHA512
a8a160da5d8b96f5a2c42b3be5c50c0ea4228eb6500ec7fe5297008ab25d204195cb2a03092bee767d4dd56ebd4ab6f150367b76bbc746933980e0a1dbf0d617

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
cfacb38cfa3c2fe6be4ab2bd2ee1e0f3

SHA1
af611ad8da7ce952b4f89c85d6c03e92f4d29c03

SHA256
1f0af9e7710318fef59bd7e633918f1dffc21c61db5eef0700b21d36499f730c

SHA512
007efd4eabddcfde0698a643a948485222b4a1124d9d79e5deecf8d609aad8b6e74cbf17230a25089094d9be404161cf263fa57a898c3ea179cba603ec46932b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
e9de31d9db3312d020b577a294226f50

SHA1
0a14f1f0171cf8d49f702699f83007b314ee9eaa

SHA256
aa1be75936c20d1c752013d5d7c2411074e86ed1c64731aee48f28f7cd21e6e2

SHA512
bbccbb34f051a751fcfbf73d7b146cb87d0debd233c4ac6ba11edcc45bd55a58411fd864791a523c9126dd10ddafe4ad50f81251c832f9cec6038fdf498563fa

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
094cf6ba801fd508f177fd15fa16e9e0

SHA1
99f3905b06c9ec1f69fce1e2001f2066d0530365

SHA256
8a2b78fab2feb693ded5911101e6191dfa29debcd06643507c7e04e5c6c2b4ab

SHA512
cddf4375d52289dab51a318fcc93ebcb7c1de4087cdcf7d6e0f218412ced6dd47256be0aa609a353db30fa022af152e2fb0c4fb9dc21bfc2d5f6c045d30ea8a5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
094cf6ba801fd508f177fd15fa16e9e0

SHA1
99f3905b06c9ec1f69fce1e2001f2066d0530365

SHA256
8a2b78fab2feb693ded5911101e6191dfa29debcd06643507c7e04e5c6c2b4ab

SHA512
cddf4375d52289dab51a318fcc93ebcb7c1de4087cdcf7d6e0f218412ced6dd47256be0aa609a353db30fa022af152e2fb0c4fb9dc21bfc2d5f6c045d30ea8a5

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\Users\Admin\AppData\Local\Temp\4CA8.dll

Filesize
4.1MB

MD5
184fc62aeb4c9d78891eb8d509c429e5

SHA1
4456d00e767b918a5118741985f2e1bc924b8e53

SHA256
6b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052

SHA512
100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
\Users\Admin\AppData\Local\Temp\is-RMQ7B.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-RMQ7B.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-RMQ7B.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-RRM0L.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/656-282-0x000000000BDA0000-0x000000000C2CC000-memory.dmp

Filesize
5.2MB

Download
memory/656-73-0x0000000009610000-0x0000000009676000-memory.dmp

Filesize
408KB

Download
memory/656-67-0x00000000093C0000-0x00000000093D0000-memory.dmp

Filesize
64KB

Download
memory/656-76-0x000000000A0C0000-0x000000000A136000-memory.dmp

Filesize
472KB

Download
memory/656-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/656-77-0x000000000A240000-0x000000000A25E000-memory.dmp

Filesize
120KB

Download
memory/656-64-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/656-281-0x000000000AD70000-0x000000000AF32000-memory.dmp

Filesize
1.8MB

Download
memory/656-384-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/656-78-0x000000000AB50000-0x000000000ABA0000-memory.dmp

Filesize
320KB

Download
memory/768-55-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/768-425-0x0000000000B50000-0x0000000000C50000-memory.dmp

Filesize
1024KB

Download
memory/768-53-0x0000000000B50000-0x0000000000C50000-memory.dmp

Filesize
1024KB

Download
memory/768-54-0x0000000000990000-0x00000000009A6000-memory.dmp

Filesize
88KB

Download
memory/896-510-0x0000000000E00000-0x0000000000E6B000-memory.dmp

Filesize
428KB

Download
memory/1052-38-0x0000000008AA0000-0x0000000008ADE000-memory.dmp

Filesize
248KB

Download
memory/1052-18-0x0000000001220000-0x0000000001D60000-memory.dmp

Filesize
11.2MB

Download
memory/1052-22-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-39-0x0000000008B00000-0x0000000008B4B000-memory.dmp

Filesize
300KB

Download
memory/1052-32-0x0000000008D40000-0x000000000923E000-memory.dmp

Filesize
5.0MB

Download
memory/1052-23-0x0000000075750000-0x0000000075912000-memory.dmp

Filesize
1.8MB

Download
memory/1052-33-0x00000000088E0000-0x0000000008972000-memory.dmp

Filesize
584KB

Download
memory/1052-65-0x0000000001220000-0x0000000001D60000-memory.dmp

Filesize
11.2MB

Download
memory/1052-34-0x00000000061C0000-0x00000000061CA000-memory.dmp

Filesize
40KB

Download
memory/1052-66-0x0000000075750000-0x0000000075912000-memory.dmp

Filesize
1.8MB

Download
memory/1052-68-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-21-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-35-0x0000000009850000-0x0000000009E56000-memory.dmp

Filesize
6.0MB

Download
memory/1052-37-0x0000000008A40000-0x0000000008A52000-memory.dmp

Filesize
72KB

Download
memory/1052-379-0x0000000075750000-0x0000000075912000-memory.dmp

Filesize
1.8MB

Download
memory/1052-378-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-381-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1052-30-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1052-31-0x0000000001220000-0x0000000001D60000-memory.dmp

Filesize
11.2MB

Download
memory/1052-27-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-20-0x0000000075750000-0x0000000075912000-memory.dmp

Filesize
1.8MB

Download
memory/1052-25-0x0000000077714000-0x0000000077715000-memory.dmp

Filesize
4KB

Download
memory/1052-283-0x00000000773E0000-0x00000000774B0000-memory.dmp

Filesize
832KB

Download
memory/1052-36-0x0000000008C10000-0x0000000008D1A000-memory.dmp

Filesize
1.0MB

Download
memory/1052-19-0x0000000075750000-0x0000000075912000-memory.dmp

Filesize
1.8MB

Download
memory/1312-540-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1312-470-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1380-609-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1380-475-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1872-419-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-415-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-412-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-410-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2424-611-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2888-438-0x0000000002F40000-0x0000000002F56000-memory.dmp

Filesize
88KB

Download
memory/2888-4-0x00000000014D0000-0x00000000014E6000-memory.dmp

Filesize
88KB

Download
memory/3448-406-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3448-46-0x00000000055D0000-0x000000000566C000-memory.dmp

Filesize
624KB

Download
memory/3448-394-0x0000000005E70000-0x0000000006098000-memory.dmp

Filesize
2.2MB

Download
memory/3448-417-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3448-395-0x00000000071D0000-0x0000000007362000-memory.dmp

Filesize
1.6MB

Download
memory/3448-403-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/3448-45-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3448-416-0x0000000007950000-0x0000000007A50000-memory.dmp

Filesize
1024KB

Download
memory/3448-405-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3448-408-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3448-411-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3448-44-0x0000000000600000-0x0000000000B14000-memory.dmp

Filesize
5.1MB

Download
memory/3448-47-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3448-413-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/4216-1-0x0000000000C00000-0x0000000000D00000-memory.dmp

Filesize
1024KB

Download
memory/4216-2-0x0000000000990000-0x000000000099B000-memory.dmp

Filesize
44KB

Download
memory/4216-3-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4216-5-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4608-694-0x0000000005120000-0x0000000005247000-memory.dmp

Filesize
1.2MB

Download
memory/4608-380-0x00000000010E0000-0x00000000010E6000-memory.dmp

Filesize
24KB

Download
memory/4608-695-0x0000000005250000-0x00000000060C3000-memory.dmp

Filesize
14.4MB

Download
memory/4608-393-0x0000000004FD0000-0x0000000005113000-memory.dmp

Filesize
1.3MB

Download
memory/4608-698-0x00000000060D0000-0x00000000061E1000-memory.dmp

Filesize
1.1MB

Download
memory/4608-704-0x00000000061F0000-0x000000000630E000-memory.dmp

Filesize
1.1MB

Download
memory/4608-710-0x00000000061F0000-0x000000000630E000-memory.dmp

Filesize
1.1MB

Download
memory/4608-751-0x0000000000D20000-0x0000000000D32000-memory.dmp

Filesize
72KB

Download
memory/4608-752-0x0000000051870000-0x00000000518C0000-memory.dmp

Filesize
320KB

Download
memory/4608-459-0x0000000010000000-0x0000000010418000-memory.dmp

Filesize
4.1MB

Download
memory/4608-402-0x0000000005120000-0x0000000005247000-memory.dmp

Filesize
1.2MB

Download
memory/4608-409-0x0000000005120000-0x0000000005247000-memory.dmp

Filesize
1.2MB

Download
memory/4608-376-0x0000000010000000-0x0000000010418000-memory.dmp

Filesize
4.1MB

Download
memory/4628-391-0x0000000000990000-0x000000000099B000-memory.dmp

Filesize
44KB

Download
memory/4628-441-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4628-392-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4628-390-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/4676-538-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4676-432-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4696-426-0x0000000002E50000-0x000000000373B000-memory.dmp

Filesize
8.9MB

Download
memory/4696-604-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4696-868-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4696-424-0x0000000002A40000-0x0000000002E41000-memory.dmp

Filesize
4.0MB

Download
memory/4696-478-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4696-427-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download