Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2023 17:22
Static task
static1
General
-
Target
be9d02e68254f125e51577acaba81f25.exe
-
Size
238KB
-
MD5
be9d02e68254f125e51577acaba81f25
-
SHA1
87a2a3ed4ae400b6c03e73d3298d37a2b9f27aea
-
SHA256
a58e48ffbc29d8dd0a8d518e4665d478ce641aa60754c38b29634e9650135e75
-
SHA512
1a524616e7b4cdbffa77ee6503c575c1f110906a594b517a70de77ca7557a3f7debc2580551cd7b8257167622d228b9c5833b341b4ea1fcef5f351a3956138c3
-
SSDEEP
3072:A0OuGN405qDf+O8sIrVAJvyMqRoR5oGiWHqTCK:q9NrqDft83hAJrv3BHqT
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Extracted
lumma
http://opposesicknessopw.pw/api
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\B45C.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\B45C.exe family_zgrat_v1 behavioral2/memory/1484-19-0x0000000000AE0000-0x0000000000FF4000-memory.dmp family_zgrat_v1 -
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1772-76-0x0000000002EC0000-0x00000000037AB000-memory.dmp family_glupteba behavioral2/memory/1772-77-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1772-273-0x0000000002EC0000-0x00000000037AB000-memory.dmp family_glupteba behavioral2/memory/1772-356-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1772-440-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1772-495-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1772-527-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Raccoon Stealer V2 payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2404-36-0x0000000002460000-0x0000000002476000-memory.dmp family_raccoon_v2 behavioral2/memory/2404-37-0x0000000000400000-0x000000000085E000-memory.dmp family_raccoon_v2 behavioral2/memory/2332-40-0x0000000004E00000-0x0000000004E10000-memory.dmp family_raccoon_v2 -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
F69D.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ F69D.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
F69D.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion F69D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion F69D.exe -
Deletes itself 1 IoCs
Processes:
pid process 3332 -
Executes dropped EXE 20 IoCs
Processes:
B45C.exeB651.exeB807.exeC71D.exeCC6D.exeD3F0.exeD3F0.tmpmdeliverylib.exemdeliverylib.exeEE6E.exeEE6E.tmpMaildelivery.exeMaildelivery.exeF69D.exeCC6D.execsrss.exeinjector.exewindefender.exewindefender.exeBFAB.exepid process 1484 B45C.exe 2404 B651.exe 4520 B807.exe 3852 C71D.exe 1772 CC6D.exe 752 D3F0.exe 3844 D3F0.tmp 4812 mdeliverylib.exe 1384 mdeliverylib.exe 4252 EE6E.exe 4332 EE6E.tmp 5312 Maildelivery.exe 5400 Maildelivery.exe 5504 F69D.exe 5180 CC6D.exe 5080 csrss.exe 5884 injector.exe 828 windefender.exe 4432 windefender.exe 2204 BFAB.exe -
Loads dropped DLL 9 IoCs
Processes:
regsvr32.exeD3F0.tmpB45C.exeEE6E.tmpBFAB.exepid process 2844 regsvr32.exe 3844 D3F0.tmp 3844 D3F0.tmp 3844 D3F0.tmp 1484 B45C.exe 4332 EE6E.tmp 4332 EE6E.tmp 4332 EE6E.tmp 2204 BFAB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\F69D.exe themida C:\Users\Admin\AppData\Local\Temp\F69D.exe themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CC6D.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" CC6D.exe Set value (str) \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
F69D.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F69D.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
F69D.exepid process 5504 F69D.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B807.exeB45C.exeBFAB.exedescription pid process target process PID 4520 set thread context of 2332 4520 B807.exe AppLaunch.exe PID 1484 set thread context of 3388 1484 B45C.exe RegSvcs.exe PID 2204 set thread context of 5208 2204 BFAB.exe RegSvcs.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
CC6D.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN CC6D.exe -
Drops file in Program Files directory 64 IoCs
Processes:
D3F0.tmpEE6E.tmpdescription ioc process File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-CJAHR.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-HM2CN.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-CJVV8.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-CAS5N.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-LHHPC.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-AEBAM.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\uninstall\unins000.dat D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-Q6HQD.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\is-SV8M0.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-199OD.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-802HN.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-PNV7G.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-T58A9.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-5N370.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-6J4H7.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-NIPN2.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-CIPHT.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-FTK00.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-NAFCI.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-JQ3A8.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-6ISVO.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-2NPK4.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-3KDEA.tmp EE6E.tmp File opened for modification C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-3UJ6I.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-ACI03.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-D2KCN.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-5UHQT.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-HFQFM.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-9595V.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-5GNDP.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-5TGPI.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-96AGT.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-LRRPM.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-BG3RR.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-RKNDG.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-650R8.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-BVQU2.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-NRVVU.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-D075C.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\is-1KPNU.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-8DUO6.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-RULET.tmp EE6E.tmp File opened for modification C:\Program Files (x86)\Maildelivery\Maildelivery.exe EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-E7GRM.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-OSFUL.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-BJMSC.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-41LKH.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-34JLO.tmp D3F0.tmp File opened for modification C:\Program Files (x86)\MDeliveryLIB\uninstall\unins000.dat D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-60OFQ.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-1BGGO.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-IH1VF.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-B8SHO.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-FH7MN.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-2SBTA.tmp D3F0.tmp File opened for modification C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-V8LMA.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\lessmsi\is-8N4RH.tmp EE6E.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-KD35E.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-Q9IHO.tmp D3F0.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-LOQOE.tmp D3F0.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-SRVIF.tmp EE6E.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-12RTT.tmp EE6E.tmp -
Drops file in Windows directory 4 IoCs
Processes:
CC6D.execsrss.exedescription ioc process File opened for modification C:\Windows\rss CC6D.exe File created C:\Windows\rss\csrss.exe CC6D.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1008 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5848 2404 WerFault.exe B651.exe 5308 1772 WerFault.exe CC6D.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
C71D.exebe9d02e68254f125e51577acaba81f25.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C71D.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C71D.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C71D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be9d02e68254f125e51577acaba81f25.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be9d02e68254f125e51577acaba81f25.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be9d02e68254f125e51577acaba81f25.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4460 schtasks.exe 5204 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exepowershell.exeCC6D.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" CC6D.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" CC6D.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
be9d02e68254f125e51577acaba81f25.exepid process 3084 be9d02e68254f125e51577acaba81f25.exe 3084 be9d02e68254f125e51577acaba81f25.exe 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 3332 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3332 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
be9d02e68254f125e51577acaba81f25.exeC71D.exepid process 3084 be9d02e68254f125e51577acaba81f25.exe 3852 C71D.exe 3332 3332 3332 3332 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AppLaunch.exeF69D.exedescription pid process Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeDebugPrivilege 2332 AppLaunch.exe Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeShutdownPrivilege 3332 Token: SeCreatePagefilePrivilege 3332 Token: SeDebugPrivilege 5504 F69D.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 3332 3332 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
B807.exeregsvr32.exeD3F0.exeD3F0.tmpnet.exeB45C.exedescription pid process target process PID 3332 wrote to memory of 1484 3332 B45C.exe PID 3332 wrote to memory of 1484 3332 B45C.exe PID 3332 wrote to memory of 1484 3332 B45C.exe PID 3332 wrote to memory of 2404 3332 B651.exe PID 3332 wrote to memory of 2404 3332 B651.exe PID 3332 wrote to memory of 2404 3332 B651.exe PID 3332 wrote to memory of 4520 3332 B807.exe PID 3332 wrote to memory of 4520 3332 B807.exe PID 3332 wrote to memory of 4520 3332 B807.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 4520 wrote to memory of 2332 4520 B807.exe AppLaunch.exe PID 3332 wrote to memory of 2456 3332 regsvr32.exe PID 3332 wrote to memory of 2456 3332 regsvr32.exe PID 2456 wrote to memory of 2844 2456 regsvr32.exe regsvr32.exe PID 2456 wrote to memory of 2844 2456 regsvr32.exe regsvr32.exe PID 2456 wrote to memory of 2844 2456 regsvr32.exe regsvr32.exe PID 3332 wrote to memory of 3852 3332 C71D.exe PID 3332 wrote to memory of 3852 3332 C71D.exe PID 3332 wrote to memory of 3852 3332 C71D.exe PID 3332 wrote to memory of 1772 3332 CC6D.exe PID 3332 wrote to memory of 1772 3332 CC6D.exe PID 3332 wrote to memory of 1772 3332 CC6D.exe PID 3332 wrote to memory of 752 3332 D3F0.exe PID 3332 wrote to memory of 752 3332 D3F0.exe PID 3332 wrote to memory of 752 3332 D3F0.exe PID 752 wrote to memory of 3844 752 D3F0.exe D3F0.tmp PID 752 wrote to memory of 3844 752 D3F0.exe D3F0.tmp PID 752 wrote to memory of 3844 752 D3F0.exe D3F0.tmp PID 3844 wrote to memory of 3744 3844 D3F0.tmp schtasks.exe PID 3844 wrote to memory of 3744 3844 D3F0.tmp schtasks.exe PID 3844 wrote to memory of 3744 3844 D3F0.tmp schtasks.exe PID 3844 wrote to memory of 4812 3844 D3F0.tmp mdeliverylib.exe PID 3844 wrote to memory of 4812 3844 D3F0.tmp mdeliverylib.exe PID 3844 wrote to memory of 4812 3844 D3F0.tmp mdeliverylib.exe PID 3844 wrote to memory of 4976 3844 D3F0.tmp net.exe PID 3844 wrote to memory of 4976 3844 D3F0.tmp net.exe PID 3844 wrote to memory of 4976 3844 D3F0.tmp net.exe PID 3844 wrote to memory of 1384 3844 D3F0.tmp mdeliverylib.exe PID 3844 wrote to memory of 1384 3844 D3F0.tmp mdeliverylib.exe PID 3844 wrote to memory of 1384 3844 D3F0.tmp mdeliverylib.exe PID 4976 wrote to memory of 3440 4976 net.exe net1.exe PID 4976 wrote to memory of 3440 4976 net.exe net1.exe PID 4976 wrote to memory of 3440 4976 net.exe net1.exe PID 1484 wrote to memory of 3272 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3272 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3272 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 1484 wrote to memory of 3388 1484 B45C.exe RegSvcs.exe PID 3332 wrote to memory of 4252 3332 EE6E.exe PID 3332 wrote to memory of 4252 3332 EE6E.exe PID 3332 wrote to memory of 4252 3332 EE6E.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be9d02e68254f125e51577acaba81f25.exe"C:\Users\Admin\AppData\Local\Temp\be9d02e68254f125e51577acaba81f25.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3084
-
C:\Users\Admin\AppData\Local\Temp\B45C.exeC:\Users\Admin\AppData\Local\Temp\B45C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:3388
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\B651.exeC:\Users\Admin\AppData\Local\Temp\B651.exe1⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 73002⤵
- Program crash
PID:5848
-
C:\Users\Admin\AppData\Local\Temp\B807.exeC:\Users\Admin\AppData\Local\Temp\B807.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C17E.dll1⤵
- Loads dropped DLL
PID:2844
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C17E.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2456
-
C:\Users\Admin\AppData\Local\Temp\C71D.exeC:\Users\Admin\AppData\Local\Temp\C71D.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3852
-
C:\Users\Admin\AppData\Local\Temp\CC6D.exeC:\Users\Admin\AppData\Local\Temp\CC6D.exe1⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\CC6D.exe"C:\Users\Admin\AppData\Local\Temp\CC6D.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5180 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4588 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:5832
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6012 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:5080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4900 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:5204 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4324
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
PID:5884 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4460 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:1540
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:1008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 6322⤵
- Program crash
PID:5308
-
C:\Users\Admin\AppData\Local\Temp\D3F0.exeC:\Users\Admin\AppData\Local\Temp\D3F0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\is-PLR6M.tmp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\is-PLR6M.tmp\D3F0.tmp" /SL5="$50230,7932209,54272,C:\Users\Admin\AppData\Local\Temp\D3F0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:3744
-
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -i3⤵
- Executes dropped EXE
PID:4812 -
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -s3⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\EE6E.exeC:\Users\Admin\AppData\Local\Temp\EE6E.exe1⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\is-127HO.tmp\EE6E.tmp"C:\Users\Admin\AppData\Local\Temp\is-127HO.tmp\EE6E.tmp" /SL5="$E022C,7905477,54272,C:\Users\Admin\AppData\Local\Temp\EE6E.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4332 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:5300
-
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -s3⤵
- Executes dropped EXE
PID:5400 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵PID:5392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:5492
-
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -i3⤵
- Executes dropped EXE
PID:5312
-
C:\Users\Admin\AppData\Local\Temp\F69D.exeC:\Users\Admin\AppData\Local\Temp\F69D.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:5504
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:5556
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2404 -ip 24041⤵PID:5832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1772 -ip 17721⤵PID:5148
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4432
-
C:\Users\Admin\AppData\Local\Temp\BFAB.exeC:\Users\Admin\AppData\Local\Temp\BFAB.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:5208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:2936
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
110KB
MD5bdb65dce335ac29eccbc2ca7a7ad36b7
SHA1ce7678dcf7af0dbf9649b660db63db87325e6f69
SHA2567ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3
SHA5128aabca6be47a365acd28df8224f9b9b5e1654f67e825719286697fb9e1b75478dddf31671e3921f06632eed5bb3dda91d81e48d4550c2dcd8e2404d566f1bc29
-
Filesize
1KB
MD5257d1bf38fa7859ffc3717ef36577c04
SHA1a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3
-
Filesize
1KB
MD5992c00beab194ce392117bb419f53051
SHA18f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA2569e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
128B
MD5785bb7f0b0cef59c39b9f5e21cd2fd04
SHA11e1ffdee1584a00bde18bd7bd19c02988301c250
SHA25690b35ec0c6b41acec2c9bb51cddcb6339fb035c222766a4ca4cbb15b7a7d8853
SHA5126d2449e111f7f059734960b83b0b090a7239ee2d93eb70f839ecddaa640658b90667f123cfb4fe8e0f5dc0a854a47b62aa2fcaf971d08b9118cac840dbf999eb
-
Filesize
8B
MD5d0e05209ef0324d022abb77d7414dac2
SHA1875260eebb5bc7f0ec8ea2f528ecb5224173f68b
SHA25696fa403c234e5d443387553bb245d5e7e9dc056ec13fc892cdf04bbcd1939473
SHA5129129eedd914649d23b935c466f5a72908ec09fb8d48264517da3b5cd572f99a597de2fc341a836498ad8e4c5f891eca520ffe1c238e18466ac52a3b971fea991
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
Filesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
Filesize
6.4MB
MD5a4ce9eab6facc5c9a722e408f735ee2a
SHA1d36c9f8b0c205dc821aa18b65536e1619ea54b69
SHA2563e2dde3ce6cb7daee5e76108d39449b867e592e22faefe63991ebbf282834483
SHA512270f906ae6101d57c2672671aa7bf7bd120f8e4eda6e2135bbc7aeb3a3b16bbf3a11099a66b81d0d58c3fa4a7fbb6bd1688516b5be5706b9f1471b6d816d03d1
-
Filesize
6.4MB
MD5a4ce9eab6facc5c9a722e408f735ee2a
SHA1d36c9f8b0c205dc821aa18b65536e1619ea54b69
SHA2563e2dde3ce6cb7daee5e76108d39449b867e592e22faefe63991ebbf282834483
SHA512270f906ae6101d57c2672671aa7bf7bd120f8e4eda6e2135bbc7aeb3a3b16bbf3a11099a66b81d0d58c3fa4a7fbb6bd1688516b5be5706b9f1471b6d816d03d1
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
230KB
MD5d43aff1b1667cf208008d4e2d76e124f
SHA1f097e2c33c9d65f20634ab8d7c4078007e96f8a9
SHA25633dcd949d98d7eae6e432af70a6b4cdc6aa8997043785c91848ad9478eff7623
SHA512ac8e1ee8ec0725129a4d2beb24188ca5572f415b0cffc52e399ee102292f0ee78f1a75eb155b3d53a1bdf53067699495f471822c29a2d71810dbef91a26e88e5
-
Filesize
230KB
MD5d43aff1b1667cf208008d4e2d76e124f
SHA1f097e2c33c9d65f20634ab8d7c4078007e96f8a9
SHA25633dcd949d98d7eae6e432af70a6b4cdc6aa8997043785c91848ad9478eff7623
SHA512ac8e1ee8ec0725129a4d2beb24188ca5572f415b0cffc52e399ee102292f0ee78f1a75eb155b3d53a1bdf53067699495f471822c29a2d71810dbef91a26e88e5
-
Filesize
4.1MB
MD5f4cc12ca64e579ab32dfbf8c431d69e6
SHA1d52d72c9a22032b5148d4ded20529eb757dcd244
SHA25670baed950fbcd28d695bedcf44d7042d0b32fae088188a4b8492d47f72320dbd
SHA512e24d017f6b28f74443f6f7feeb2319c1205a74ab238bc086c79597be22ab9468eac54439c91b52b407b3782442f1ada4b928eece7dcde94035774b69ef3fd858
-
Filesize
4.1MB
MD5f4cc12ca64e579ab32dfbf8c431d69e6
SHA1d52d72c9a22032b5148d4ded20529eb757dcd244
SHA25670baed950fbcd28d695bedcf44d7042d0b32fae088188a4b8492d47f72320dbd
SHA512e24d017f6b28f74443f6f7feeb2319c1205a74ab238bc086c79597be22ab9468eac54439c91b52b407b3782442f1ada4b928eece7dcde94035774b69ef3fd858
-
Filesize
4.1MB
MD5f4cc12ca64e579ab32dfbf8c431d69e6
SHA1d52d72c9a22032b5148d4ded20529eb757dcd244
SHA25670baed950fbcd28d695bedcf44d7042d0b32fae088188a4b8492d47f72320dbd
SHA512e24d017f6b28f74443f6f7feeb2319c1205a74ab238bc086c79597be22ab9468eac54439c91b52b407b3782442f1ada4b928eece7dcde94035774b69ef3fd858
-
Filesize
7.8MB
MD53b037168cf1d986804e9821a66069d84
SHA1fe1d1b19a050599e81ea82637f26c33412fabfb9
SHA2566c220e8d4929f29a91b30dcf4cc928d02896cd98424900b2264da5f2e5ecd983
SHA51258de6c0212fb48966a27d64dbaa65c27019edd92bdc375b9502fdc54a51cbf4f0be351b7e4a2a907d54aa817d452cc921f494cdf3a824da5be915d46a7af912d
-
Filesize
7.8MB
MD53b037168cf1d986804e9821a66069d84
SHA1fe1d1b19a050599e81ea82637f26c33412fabfb9
SHA2566c220e8d4929f29a91b30dcf4cc928d02896cd98424900b2264da5f2e5ecd983
SHA51258de6c0212fb48966a27d64dbaa65c27019edd92bdc375b9502fdc54a51cbf4f0be351b7e4a2a907d54aa817d452cc921f494cdf3a824da5be915d46a7af912d
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
230KB
MD5d43aff1b1667cf208008d4e2d76e124f
SHA1f097e2c33c9d65f20634ab8d7c4078007e96f8a9
SHA25633dcd949d98d7eae6e432af70a6b4cdc6aa8997043785c91848ad9478eff7623
SHA512ac8e1ee8ec0725129a4d2beb24188ca5572f415b0cffc52e399ee102292f0ee78f1a75eb155b3d53a1bdf53067699495f471822c29a2d71810dbef91a26e88e5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD540889ceb3de223241e61209015379af3
SHA1529547da95c3de8d90ea0c7abba9f1b9ab16a7ab
SHA2563e70df6ec4e2624fa6e65f82c5ff949cf70d67c5789d87c65153072ee7958bb1
SHA51271839634d7c1296d646f44743de722479c8d407a6ef2dd266982f77182242307102e4275e7d05258fdf7e4705a25e62a1988b5aa174858db504f9b0b280c1664
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a62225d8eb4050c298e2e98d8e03d6b0
SHA1b42b87015a4537c3a6db734ced5252b448a50a03
SHA25673864400dcf7b06eceb4564532d198d4f214536fb92e48f9710d9a9b3d495ce8
SHA512a0f8f494ff4f32264456a71fa2f2f063b65db59ea6db7102ec52f91e55ce447758fe3c2affc9aea9e89622057c6c1e4d27ae6524a0b2848780660b8cf3cca91e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57d3bb7d80cd2f87e079331788f97a4eb
SHA194913c50ecb14a81a46e4e49c25999dea064b7be
SHA2562e58a1345348dbe77e9ab802dc01ff2218c79960f506ad028cc8753c38dfafa9
SHA51240795798fb5dc4d55eab148aeeb2ece0efef7ecd44f61312ce7c77f5da7207f66297c222518d03a70eca1b302c462079ef6638071a0af917b5336e44f84dd122
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD541e476be7bdec6a6eaf70e85ad958f56
SHA1402e5509a1da41d2f929451d65d5ab4f130c32bb
SHA256d162bf158cc659c7cd002747efc5d7e49c921d7e978a1575f8394d0bdcd4fd47
SHA512de6d720e7f16087e376a15ed54c51fa5648c083000c2e7a170e03248be85046cb81289be33f705eb4c6d4890ef7c59d32aed10e2b2c742232f2395c55ada6687
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5566a782af1057ba2c7a70e9ce348c366
SHA1b3087eb6b27648618a7fea3886540ca62815ef97
SHA2563c2dee96a1ef9c87dd2812b6506be6bc996d31f708c5c6ecda16ba659b825c66
SHA51238cfa516355e751d4cbd989d3e1f3cafcc721229714f344b3ff52d0e9d05ac9ef2de7b130156bb36e622d6febec4deaa1355a21629e8588c10e96fa378afb1f4
-
Filesize
4.1MB
MD5f4cc12ca64e579ab32dfbf8c431d69e6
SHA1d52d72c9a22032b5148d4ded20529eb757dcd244
SHA25670baed950fbcd28d695bedcf44d7042d0b32fae088188a4b8492d47f72320dbd
SHA512e24d017f6b28f74443f6f7feeb2319c1205a74ab238bc086c79597be22ab9468eac54439c91b52b407b3782442f1ada4b928eece7dcde94035774b69ef3fd858
-
Filesize
4.1MB
MD5f4cc12ca64e579ab32dfbf8c431d69e6
SHA1d52d72c9a22032b5148d4ded20529eb757dcd244
SHA25670baed950fbcd28d695bedcf44d7042d0b32fae088188a4b8492d47f72320dbd
SHA512e24d017f6b28f74443f6f7feeb2319c1205a74ab238bc086c79597be22ab9468eac54439c91b52b407b3782442f1ada4b928eece7dcde94035774b69ef3fd858
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec