Analysis
-
max time kernel
88s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2023 21:04
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231127-en
General
-
Target
file.exe
-
Size
237KB
-
MD5
4bf04827f621e897a1032d9b8bde68ab
-
SHA1
9db60a63745b44d5341df6150bf58bed781f0919
-
SHA256
c3b536ff860e68e9a0821b133a6858aa4f985c265a2619237396a0cde8e17b6f
-
SHA512
2bc1847aa32769e51f02693e39307d72e8762e5b01d4c5726f4859278ebbc21fefdcab13626ffa9ae8b848a134affadc014a5562af3a4e8f3d3f325552dbe4c1
-
SSDEEP
3072:JLFmtP/Al+PUvLzYJlBisZ4Omno54oiRFAVZ5OeTC8L:mtPoEPUvXwlBisZ4ZopCY3T
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
57.128.155.22:20154
Extracted
lumma
http://opposesicknessopw.pw/api
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\D57B.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\D57B.exe family_zgrat_v1 behavioral2/memory/1492-23-0x0000000000C60000-0x0000000001174000-memory.dmp family_zgrat_v1 -
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2160-53-0x0000000002EA0000-0x000000000378B000-memory.dmp family_glupteba behavioral2/memory/2160-54-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2160-242-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2160-281-0x0000000002EA0000-0x000000000378B000-memory.dmp family_glupteba behavioral2/memory/2160-428-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2160-424-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2160-544-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Raccoon Stealer V2 payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3240-29-0x0000000000980000-0x0000000000996000-memory.dmp family_raccoon_v2 behavioral2/memory/3240-31-0x0000000000400000-0x000000000085E000-memory.dmp family_raccoon_v2 behavioral2/memory/3240-64-0x0000000000400000-0x000000000085E000-memory.dmp family_raccoon_v2 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2968-469-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
3601.exeConhost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3601.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Conhost.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3601.exeConhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3601.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3601.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Conhost.exe -
Deletes itself 1 IoCs
Processes:
pid process 3340 -
Executes dropped EXE 16 IoCs
Processes:
D57B.exeD6F3.exeE5F9.exeEC72.exeFF30.exeFF30.tmpmdeliverylib.exemdeliverylib.exe28E1.exe28E1.tmp3601.exeMaildelivery.exesvchost.exeMaildelivery.exeEC72.exeConhost.exepid process 1492 D57B.exe 3240 D6F3.exe 3896 E5F9.exe 2160 EC72.exe 4032 FF30.exe 4772 FF30.tmp 4988 mdeliverylib.exe 1964 mdeliverylib.exe 4616 28E1.exe 3432 28E1.tmp 4560 3601.exe 2948 Maildelivery.exe 2912 svchost.exe 64 Maildelivery.exe 4648 EC72.exe 536 Conhost.exe -
Loads dropped DLL 8 IoCs
Processes:
regsvr32.exeFF30.tmpD57B.exe28E1.tmppid process 3044 regsvr32.exe 4772 FF30.tmp 4772 FF30.tmp 4772 FF30.tmp 1492 D57B.exe 3432 28E1.tmp 3432 28E1.tmp 3432 28E1.tmp -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3601.exe themida C:\Users\Admin\AppData\Local\Temp\3601.exe themida behavioral2/memory/4560-443-0x0000000000210000-0x0000000000AA2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida C:\Users\Admin\AppData\Local\Temp\mi.exe themida behavioral2/memory/536-584-0x00007FF68D850000-0x00007FF68E5BE000-memory.dmp themida behavioral2/memory/536-586-0x00007FF68D850000-0x00007FF68E5BE000-memory.dmp themida behavioral2/memory/536-588-0x00007FF68D850000-0x00007FF68E5BE000-memory.dmp themida C:\ProgramData\Google\Chrome\updater.exe themida C:\ProgramData\Google\Chrome\updater.exe themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
3601.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3601.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
3601.exeConhost.exepid process 4560 3601.exe 536 Conhost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
D57B.exesvchost.exedescription pid process target process PID 1492 set thread context of 1088 1492 D57B.exe RegSvcs.exe PID 2912 set thread context of 2968 2912 svchost.exe AppLaunch.exe -
Drops file in Program Files directory 64 IoCs
Processes:
FF30.tmp28E1.tmpdescription ioc process File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-T5A00.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-1E93H.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\lessmsi\is-P5CER.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\plugins\internal\is-O3ALQ.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-RFVS3.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\uninstall\is-L701L.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-AEIDB.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-JBVDM.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-K2QS4.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-2G3K0.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-V833B.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-7UKOI.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-EJ0I3.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-P8QDR.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-DF418.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-HPMTN.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-TMSO5.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-V6LGK.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-QMPKS.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-74I4F.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-NHM9G.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-3UTR6.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-SL3EE.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-5F7L0.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-5M6TU.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-LFEVQ.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-3LI8F.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-36RLF.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-FAHCN.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\plugins\internal\is-9V104.tmp 28E1.tmp File opened for modification C:\Program Files (x86)\Maildelivery\Maildelivery.exe 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-TO237.tmp FF30.tmp File opened for modification C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-9NUGT.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\stuff\is-20JN7.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-I5BD3.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat 28E1.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-MG53U.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-VCQLK.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-TGDC3.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-E35MH.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-JC79F.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-1HUOL.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-9U26G.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-5BCJQ.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-F0BBK.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-680EI.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\plugins\internal\is-LO7RU.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-HD9O9.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-CPBO8.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-5IEB7.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-BM08J.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-DPLEK.tmp 28E1.tmp File opened for modification C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-GLAMF.tmp FF30.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-4GUGH.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-UV6IR.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-Q5US5.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-SCI8M.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-MI0JU.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\bin\x86\is-65GA3.tmp 28E1.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-QAFK4.tmp 28E1.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-BBL3S.tmp FF30.tmp File created C:\Program Files (x86)\MDeliveryLIB\bin\x86\is-D0UFC.tmp FF30.tmp -
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1564 sc.exe 1432 sc.exe 3196 sc.exe 1688 sc.exe 3200 sc.exe 4652 sc.exe 2288 sc.exe 3192 sc.exe 4012 sc.exe 4832 sc.exe 4560 sc.exe 1700 sc.exe 4632 sc.exe 4572 sc.exe 2648 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3324 1088 WerFault.exe RegSvcs.exe 4408 3240 WerFault.exe D6F3.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exeE5F9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E5F9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E5F9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E5F9.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 408 schtasks.exe 3584 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
EC72.exeConhost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" EC72.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" EC72.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Conhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" EC72.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1020 file.exe 1020 file.exe 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 3340 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3340 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
file.exeE5F9.exepid process 1020 file.exe 3896 E5F9.exe 3340 3340 3340 3340 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeAppLaunch.exedescription pid process Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeDebugPrivilege 2316 powershell.exe Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeDebugPrivilege 2968 AppLaunch.exe Token: SeShutdownPrivilege 3340 Token: SeCreatePagefilePrivilege 3340 Token: SeDebugPrivilege 2160 Token: SeImpersonatePrivilege 2160 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.exeFF30.exeFF30.tmpAppLaunch.exeD57B.exe28E1.exe28E1.tmpEC72.exedescription pid process target process PID 3340 wrote to memory of 1492 3340 D57B.exe PID 3340 wrote to memory of 1492 3340 D57B.exe PID 3340 wrote to memory of 1492 3340 D57B.exe PID 3340 wrote to memory of 3240 3340 D6F3.exe PID 3340 wrote to memory of 3240 3340 D6F3.exe PID 3340 wrote to memory of 3240 3340 D6F3.exe PID 3340 wrote to memory of 2316 3340 regsvr32.exe PID 3340 wrote to memory of 2316 3340 regsvr32.exe PID 2316 wrote to memory of 3044 2316 powershell.exe regsvr32.exe PID 2316 wrote to memory of 3044 2316 powershell.exe regsvr32.exe PID 2316 wrote to memory of 3044 2316 powershell.exe regsvr32.exe PID 3340 wrote to memory of 3896 3340 E5F9.exe PID 3340 wrote to memory of 3896 3340 E5F9.exe PID 3340 wrote to memory of 3896 3340 E5F9.exe PID 3340 wrote to memory of 2160 3340 EC72.exe PID 3340 wrote to memory of 2160 3340 EC72.exe PID 3340 wrote to memory of 2160 3340 EC72.exe PID 3340 wrote to memory of 4032 3340 FF30.exe PID 3340 wrote to memory of 4032 3340 FF30.exe PID 3340 wrote to memory of 4032 3340 FF30.exe PID 4032 wrote to memory of 4772 4032 FF30.exe FF30.tmp PID 4032 wrote to memory of 4772 4032 FF30.exe FF30.tmp PID 4032 wrote to memory of 4772 4032 FF30.exe FF30.tmp PID 4772 wrote to memory of 980 4772 FF30.tmp schtasks.exe PID 4772 wrote to memory of 980 4772 FF30.tmp schtasks.exe PID 4772 wrote to memory of 980 4772 FF30.tmp schtasks.exe PID 4772 wrote to memory of 4988 4772 FF30.tmp mdeliverylib.exe PID 4772 wrote to memory of 4988 4772 FF30.tmp mdeliverylib.exe PID 4772 wrote to memory of 4988 4772 FF30.tmp mdeliverylib.exe PID 4772 wrote to memory of 2968 4772 FF30.tmp AppLaunch.exe PID 4772 wrote to memory of 2968 4772 FF30.tmp AppLaunch.exe PID 4772 wrote to memory of 2968 4772 FF30.tmp AppLaunch.exe PID 4772 wrote to memory of 1964 4772 FF30.tmp mdeliverylib.exe PID 4772 wrote to memory of 1964 4772 FF30.tmp mdeliverylib.exe PID 4772 wrote to memory of 1964 4772 FF30.tmp mdeliverylib.exe PID 2968 wrote to memory of 4608 2968 AppLaunch.exe net1.exe PID 2968 wrote to memory of 4608 2968 AppLaunch.exe net1.exe PID 2968 wrote to memory of 4608 2968 AppLaunch.exe net1.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 1492 wrote to memory of 1088 1492 D57B.exe RegSvcs.exe PID 3340 wrote to memory of 4616 3340 28E1.exe PID 3340 wrote to memory of 4616 3340 28E1.exe PID 3340 wrote to memory of 4616 3340 28E1.exe PID 4616 wrote to memory of 3432 4616 28E1.exe 28E1.tmp PID 4616 wrote to memory of 3432 4616 28E1.exe 28E1.tmp PID 4616 wrote to memory of 3432 4616 28E1.exe 28E1.tmp PID 3340 wrote to memory of 4560 3340 3601.exe PID 3340 wrote to memory of 4560 3340 3601.exe PID 3340 wrote to memory of 4560 3340 3601.exe PID 3432 wrote to memory of 1768 3432 28E1.tmp schtasks.exe PID 3432 wrote to memory of 1768 3432 28E1.tmp schtasks.exe PID 3432 wrote to memory of 1768 3432 28E1.tmp schtasks.exe PID 3432 wrote to memory of 2948 3432 28E1.tmp Maildelivery.exe PID 3432 wrote to memory of 2948 3432 28E1.tmp Maildelivery.exe PID 3432 wrote to memory of 2948 3432 28E1.tmp Maildelivery.exe PID 2160 wrote to memory of 2316 2160 EC72.exe powershell.exe PID 2160 wrote to memory of 2316 2160 EC72.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1020
-
C:\Users\Admin\AppData\Local\Temp\D57B.exeC:\Users\Admin\AppData\Local\Temp\D57B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵PID:1088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 7603⤵
- Program crash
PID:3324
-
C:\Users\Admin\AppData\Local\Temp\D6F3.exeC:\Users\Admin\AppData\Local\Temp\D6F3.exe1⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 79482⤵
- Program crash
PID:4408
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\DD5D.dll1⤵PID:2316
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\DD5D.dll2⤵
- Loads dropped DLL
PID:3044
-
C:\Users\Admin\AppData\Local\Temp\E5F9.exeC:\Users\Admin\AppData\Local\Temp\E5F9.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3896
-
C:\Users\Admin\AppData\Local\Temp\EC72.exeC:\Users\Admin\AppData\Local\Temp\EC72.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\EC72.exe"C:\Users\Admin\AppData\Local\Temp\EC72.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:1060
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:2704
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2160 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:1528
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:4024
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:2856
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:3860
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:408 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4408
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:3912
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:468
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3584 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4872
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:4960
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FF30.exeC:\Users\Admin\AppData\Local\Temp\FF30.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\is-Q94OV.tmp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q94OV.tmp\FF30.tmp" /SL5="$C007C,7932209,54272,C:\Users\Admin\AppData\Local\Temp\FF30.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:980
-
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -i3⤵
- Executes dropped EXE
PID:4988 -
C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe"C:\Program Files (x86)\MDeliveryLIB\mdeliverylib.exe" -s3⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵PID:2968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1088 -ip 10881⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\28E1.exeC:\Users\Admin\AppData\Local\Temp\28E1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\is-2TAD1.tmp\28E1.tmp"C:\Users\Admin\AppData\Local\Temp\is-2TAD1.tmp\28E1.tmp" /SL5="$800DC,7905477,54272,C:\Users\Admin\AppData\Local\Temp\28E1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1768
-
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -i3⤵
- Executes dropped EXE
PID:2948 -
C:\Program Files (x86)\Maildelivery\Maildelivery.exe"C:\Program Files (x86)\Maildelivery\Maildelivery.exe" -s3⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 83⤵PID:4716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 84⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\3601.exeC:\Users\Admin\AppData\Local\Temp\3601.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4560
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3240 -ip 32401⤵PID:4284
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3976
-
C:\Users\Admin\AppData\Local\Temp\39FA.exeC:\Users\Admin\AppData\Local\Temp\39FA.exe1⤵PID:2912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\mi.exe"C:\Users\Admin\AppData\Local\Temp\mi.exe"3⤵PID:536
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵PID:4608
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:4572 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵PID:3624
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:416
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:4560 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:1700 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:3196 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Modifies data under HKEY_USERS
PID:1060 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:1688 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵PID:2408
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵PID:1284
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:1564 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵PID:3220
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵PID:4980
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
PID:2648 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
PID:4012 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:2288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2912
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵PID:508
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵PID:2512
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3192 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:2752
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1580
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1432 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3200 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:536 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4832 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4632 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵PID:5036
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵PID:2040
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:3012
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵PID:3148
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵PID:3584
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:2336
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:4600
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD5b059487c088313cc077fadae5ed4f6e6
SHA11ecdfc58d1949fa96302232a9021acd6192fe9c0
SHA2563cb709f9a03313d8a89a5628f9f43de69adadb27b657b9631c1460f0640f0344
SHA51259c20706353889691d257f6603decd6159b40c1ba546e0bb70b95359962e2d69b76c63ef82a1d6f5a8bf877793abefe9661f8e5b30cc0e19b8430e20366368d5
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
110KB
MD5bdb65dce335ac29eccbc2ca7a7ad36b7
SHA1ce7678dcf7af0dbf9649b660db63db87325e6f69
SHA2567ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3
SHA5128aabca6be47a365acd28df8224f9b9b5e1654f67e825719286697fb9e1b75478dddf31671e3921f06632eed5bb3dda91d81e48d4550c2dcd8e2404d566f1bc29
-
Filesize
1KB
MD5992c00beab194ce392117bb419f53051
SHA18f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA2569e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d
-
Filesize
1KB
MD5257d1bf38fa7859ffc3717ef36577c04
SHA1a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
3.5MB
MD527afd644b9ee5bf5b70c6a7793842ffb
SHA19e6e7cfbd05127413f629e743f8b917d2827ca36
SHA256e19cfb7de1b988ac75beb15b974d03bc1366c94daf8f65110243234147281e1c
SHA5124c3efcbcbfe1b7e234362da27a3e9bd493cadb594a2590c72a7afcc2c92d47863d2d98ce11d7b3339cc67b5e2fb37f3d39397651eeb5c091fb3f162eccd1f9a1
-
Filesize
128B
MD5785bb7f0b0cef59c39b9f5e21cd2fd04
SHA11e1ffdee1584a00bde18bd7bd19c02988301c250
SHA25690b35ec0c6b41acec2c9bb51cddcb6339fb035c222766a4ca4cbb15b7a7d8853
SHA5126d2449e111f7f059734960b83b0b090a7239ee2d93eb70f839ecddaa640658b90667f123cfb4fe8e0f5dc0a854a47b62aa2fcaf971d08b9118cac840dbf999eb
-
Filesize
8B
MD52397bc9861942283c65887c37794d068
SHA1cee6cdd3aac5e5b6f3004d6b551f9259aef54edb
SHA2563aad4ca2e879df8404bcc9046383c31a94ea1e951da2df82ead08ab831d9c2c3
SHA512ecfe752a0bb9d2c9ac00af51223a94b2e05bf5d833dacf8856293a44c539b83ff3f4f6f5ce902954753b303aaf5fab88a3406c83bb6f91e859832f392427abb5
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
7.8MB
MD58e4ababd8277cb8fd39a6866789d6a33
SHA1145d8720b4c49948bf679d3baf47a738252ece62
SHA2568d4b655539b3756721a3c26394ac2af82db97ccb04f1672881c5496d0a2f2e71
SHA5127d9f98770da3a1f1ae77229cf6928541c624e1bf47e3270228599a93448c312e27f32bcfe172a51225b3086d2ca5e806145423fc1b95fc8a828a9e30edde576e
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
3.0MB
MD5f4cb9c8b7e02e8084008cd61e1899390
SHA1af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
-
Filesize
439KB
MD5b51bc8f85b7ba047b35022f505066b72
SHA14dd8e61f706c3057995a447d8f1c0c08f8ce6d9a
SHA256fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757
SHA5127b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd
-
Filesize
439KB
MD5b51bc8f85b7ba047b35022f505066b72
SHA14dd8e61f706c3057995a447d8f1c0c08f8ce6d9a
SHA256fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757
SHA5127b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
Filesize
230KB
MD55d41949bed012250026e0d4b090c1687
SHA1bdc468f92299a309a041d7d1ee21a07066e738be
SHA2560a74a18fe824e8366e19583d77ec32e4d9d1ed3c8e7268b93405ca7184741653
SHA51207faae9abd5b1a473c04bdc3585c229887e4459365ff66eb8b19788b628d75e44062d3dfe3f6640186d53997d221fc3a7508619f61b8ae1f84394927b8e0c52f
-
Filesize
230KB
MD55d41949bed012250026e0d4b090c1687
SHA1bdc468f92299a309a041d7d1ee21a07066e738be
SHA2560a74a18fe824e8366e19583d77ec32e4d9d1ed3c8e7268b93405ca7184741653
SHA51207faae9abd5b1a473c04bdc3585c229887e4459365ff66eb8b19788b628d75e44062d3dfe3f6640186d53997d221fc3a7508619f61b8ae1f84394927b8e0c52f
-
Filesize
4.1MB
MD55d920278e0c6a27628803b31a19aa70c
SHA1404ba085ddb7f6f7a4577f758bc0e3fbbd95eac6
SHA256fd5e43111ccc8e390ce0f91e81bd0ea7043f4b4ef5a5f8830c7bc2f8a9e28831
SHA512f597605024be8e2c741e953bee18e71cc46828df67a862f27a00d0718119f33e2dcbb9af3d90dd77b459780497ae95edf470807ffe10d382d5b27fadb1447128
-
Filesize
4.1MB
MD55d920278e0c6a27628803b31a19aa70c
SHA1404ba085ddb7f6f7a4577f758bc0e3fbbd95eac6
SHA256fd5e43111ccc8e390ce0f91e81bd0ea7043f4b4ef5a5f8830c7bc2f8a9e28831
SHA512f597605024be8e2c741e953bee18e71cc46828df67a862f27a00d0718119f33e2dcbb9af3d90dd77b459780497ae95edf470807ffe10d382d5b27fadb1447128
-
Filesize
4.1MB
MD55d920278e0c6a27628803b31a19aa70c
SHA1404ba085ddb7f6f7a4577f758bc0e3fbbd95eac6
SHA256fd5e43111ccc8e390ce0f91e81bd0ea7043f4b4ef5a5f8830c7bc2f8a9e28831
SHA512f597605024be8e2c741e953bee18e71cc46828df67a862f27a00d0718119f33e2dcbb9af3d90dd77b459780497ae95edf470807ffe10d382d5b27fadb1447128
-
Filesize
7.8MB
MD5694d97658ad3c64671a08dd5e096de95
SHA1fd00300f089e866183d78de4faa129f779a159a2
SHA25665243d77df2822bbdf43ab71d5cccf077279da57a664f63c0912673c8541bb78
SHA5121c5c6428b7acea709e49e07fc8e9905c0897019bf33bf32fd68e7005361ca89f88ea9575b7476e73d4ade35e8d4a260b4a6bd55efe0c5bd89b6380cde459c45e
-
Filesize
7.8MB
MD5694d97658ad3c64671a08dd5e096de95
SHA1fd00300f089e866183d78de4faa129f779a159a2
SHA25665243d77df2822bbdf43ab71d5cccf077279da57a664f63c0912673c8541bb78
SHA5121c5c6428b7acea709e49e07fc8e9905c0897019bf33bf32fd68e7005361ca89f88ea9575b7476e73d4ade35e8d4a260b4a6bd55efe0c5bd89b6380cde459c45e
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
8.1MB
MD5b0161afbab78849d10cb7d3f00bb4ec3
SHA1542faa594a2a90b9f37c290a5d6a39bf776ce380
SHA256aac4360aef3be725b0ea05262031a6cfe237fb11dac457d3da66305dacaf1684
SHA51284778ad9f7755c259f4fbdf24287734eb43a1c5ab4fe5bd635ec83c4e982bbaa0f7efc65da7c80ed8aa8a96519ee550337c6e61f609eb9555727f52716fb80dc
-
Filesize
230KB
MD55d41949bed012250026e0d4b090c1687
SHA1bdc468f92299a309a041d7d1ee21a07066e738be
SHA2560a74a18fe824e8366e19583d77ec32e4d9d1ed3c8e7268b93405ca7184741653
SHA51207faae9abd5b1a473c04bdc3585c229887e4459365ff66eb8b19788b628d75e44062d3dfe3f6640186d53997d221fc3a7508619f61b8ae1f84394927b8e0c52f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fd028fea523deeb4800655fa298437af
SHA13630fef6612f3f94f07c04c3ee9b9023996e4212
SHA256b9879b71f5d8314e8ed0fb8697cdba3c38a00b0a315dedaea5f2fa00f205f9f9
SHA512a3ef58ae46f703732a06073167a83dc06898e5c53dd2e9eef1b2fd0f106232150a86465c0b968278fabe8cc8841eefb8bf66a8d814bdb5981d16a6b867446ad6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD568f7b9256e00fe15fb934a4898ae31d5
SHA1b98b8aaeb02c9e5a29a50cc910e73d1800f62093
SHA256d7a3d954e8882aa05112262b4945cc27bcce1331e6ae5653ac40dcb70c68ddc4
SHA51295a611416323f0047d9bbdd1a3df31752603be44a44c2b02183a888d146ea99cc88a5f8b9a811b2f9fab84a8dbd3014df0961d693c790fddf0bfda8fb2cb16a1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD572e87a054d5e586eb5abcc3abdc8ca0e
SHA1e7b9971917c48530bd68b1cc63e6dec1f841ffac
SHA256485b8c79b645ac9e5fc23be42b2a67dbae6c09b0a00871fddbffb8f80f821435
SHA512eeab71f0ebc40a0293bc651a920958d92889ac5777ca5066f0322f0147a311a1bc85db8a6294a58f8fbc7db89970cd49bdb62fe0e86bbf7e207356c4468f35a9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fda2aabc0ca13f4bd713feb7946aab53
SHA17fa55179264ef48fca3759062c5857a764d8f22f
SHA2560749960178173d22d7712b4963fe39d0ca495dbc1dc506b5f45babcc45214b65
SHA512621ed39b8c2e68f83bd0fccff2c6aacfc8fcdda5a94cbe8bc9da9825a92d7470ff0e3c2f88b4925109e8393ed54913c8355f238246fb9945cd8d12d20b89413e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52887eee848d772b1c9d820c9a660bc2b
SHA122aa75146b53c34a62ce503bc02f66d06fb73f38
SHA2566ff0b264594fdac72c7879fdbb2ea3ba636405a3180de968cc83f13fa1d66b85
SHA51235091f50063478e1103781c6a7da5535cc5522e9021e4b3d8f5453caa93ff1727a98cdab99a99de6413a977380302f1b54a26b312b17da195a675297c27ca4b3
-
Filesize
4.1MB
MD55d920278e0c6a27628803b31a19aa70c
SHA1404ba085ddb7f6f7a4577f758bc0e3fbbd95eac6
SHA256fd5e43111ccc8e390ce0f91e81bd0ea7043f4b4ef5a5f8830c7bc2f8a9e28831
SHA512f597605024be8e2c741e953bee18e71cc46828df67a862f27a00d0718119f33e2dcbb9af3d90dd77b459780497ae95edf470807ffe10d382d5b27fadb1447128
-
Filesize
4.1MB
MD55d920278e0c6a27628803b31a19aa70c
SHA1404ba085ddb7f6f7a4577f758bc0e3fbbd95eac6
SHA256fd5e43111ccc8e390ce0f91e81bd0ea7043f4b4ef5a5f8830c7bc2f8a9e28831
SHA512f597605024be8e2c741e953bee18e71cc46828df67a862f27a00d0718119f33e2dcbb9af3d90dd77b459780497ae95edf470807ffe10d382d5b27fadb1447128
-
Filesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec