Analysis
-
max time kernel
48s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 15:22
Static task
static1
Behavioral task
behavioral1
Sample
2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe
Resource
win10v2004-20231215-en
General
-
Target
2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe
-
Size
791KB
-
MD5
92e801725271ed67717bfcd1cd524eee
-
SHA1
8e30f78e231a605b2875bfed3b743bce73313093
-
SHA256
2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb
-
SHA512
1c3b75718fe87eb74374b1d8fd6d0df7cf8e37751552775803fa703744f1e3437e40a06340630917fb450f25ac518ae888f0a866068b250afea315a47472ac98
-
SSDEEP
12288:LrS+EN/44n7o7YNQdDzdYD/jGW/nSFuVD3N3iFWM6+gjN3sUNv21hXxtf:LB844nEwQhRHW/nSFuVRC9ncebBtf
Malware Config
Extracted
amadey
4.15
http://185.215.113.68
-
install_dir
d887ceb89d
-
install_file
explorhe.exe
-
strings_key
7cadc181267fafff9df8503e730d60e1
-
url_paths
/theme/index.php
Extracted
risepro
193.233.132.62:50500
Extracted
smokeloader
pub1
Extracted
stealc
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Extracted
amadey
http://185.215.113.68
-
strings_key
7cadc181267fafff9df8503e730d60e1
-
url_paths
/theme/index.php
Extracted
fabookie
http://app.alie3ksgaa.com/check/safe
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdpo
-
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Fabookie payload 1 IoCs
resource yara_rule behavioral2/memory/4776-325-0x0000000003000000-0x0000000003130000-memory.dmp family_fabookie -
Detected Djvu ransomware 4 IoCs
resource yara_rule behavioral2/memory/4100-804-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4100-803-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4100-800-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4100-815-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 6 IoCs
resource yara_rule behavioral2/memory/4088-430-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3408-483-0x0000000002F30000-0x000000000381B000-memory.dmp family_glupteba behavioral2/memory/3408-484-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3408-625-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3408-663-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2160-788-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 6 IoCs
flow pid Process 142 2732 rundll32.exe 60 4116 schtasks.exe 63 4116 schtasks.exe 65 4116 schtasks.exe 67 4116 schtasks.exe 70 4116 schtasks.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1036 netsh.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation explorhe.exe Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation latestrocki.exe Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation nstA961.tmp -
Executes dropped EXE 14 IoCs
pid Process 2824 explorhe.exe 4620 livak.exe 5068 zonak.exe 4648 SetupPowerGREPDemo.exe 1712 latestrocki.exe 652 InstallSetup7.exe 4068 toolspub1.exe 4088 31839b57a4f11171d6abc8bbc4451ee4.exe 4776 rty25.exe 4276 BroomSetup.exe 2088 nstA961.tmp 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 2160 csrss.exe 2220 explorhe.exe -
Loads dropped DLL 5 IoCs
pid Process 652 InstallSetup7.exe 652 InstallSetup7.exe 2732 rundll32.exe 2088 nstA961.tmp 2088 nstA961.tmp -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 208 icacls.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0006000000023284-820.dat upx behavioral2/files/0x0006000000023284-828.dat upx behavioral2/files/0x0006000000023284-832.dat upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\livak.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000392001\\livak.exe" explorhe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zonak.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000434001\\zonak.exe" explorhe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 112 api.2ip.ua 117 api.2ip.ua -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive icacls.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log icacls.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 5068 zonak.exe 2824 explorhe.exe 5068 zonak.exe 2824 explorhe.exe 5068 zonak.exe 2824 explorhe.exe 5068 zonak.exe 2824 explorhe.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4648 set thread context of 3720 4648 SetupPowerGREPDemo.exe 144 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2416 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 580 4088 WerFault.exe 104 1592 2088 WerFault.exe 107 1012 3584 WerFault.exe 158 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 nstA961.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString nstA961.tmp -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3096 schtasks.exe 4900 schtasks.exe 4116 schtasks.exe 4956 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2680 timeout.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs icacls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs icacls.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs icacls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ icacls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates icacls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4068 toolspub1.exe 4068 toolspub1.exe 4108 powershell.exe 4108 powershell.exe 2088 nstA961.tmp 2088 nstA961.tmp 4108 powershell.exe 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found 3352 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4068 toolspub1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4108 powershell.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeDebugPrivilege 208 icacls.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeDebugPrivilege 4764 powershell.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeDebugPrivilege 4848 powershell.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeDebugPrivilege 4792 powershell.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeDebugPrivilege 3548 powershell.exe Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found Token: SeShutdownPrivilege 3352 Process not Found Token: SeCreatePagefilePrivilege 3352 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4244 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4244 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe 2824 explorhe.exe 5068 zonak.exe 4276 BroomSetup.exe 2220 explorhe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 2824 4244 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe 88 PID 4244 wrote to memory of 2824 4244 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe 88 PID 4244 wrote to memory of 2824 4244 2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe 88 PID 2824 wrote to memory of 3096 2824 explorhe.exe 89 PID 2824 wrote to memory of 3096 2824 explorhe.exe 89 PID 2824 wrote to memory of 3096 2824 explorhe.exe 89 PID 2824 wrote to memory of 4620 2824 explorhe.exe 91 PID 2824 wrote to memory of 4620 2824 explorhe.exe 91 PID 2824 wrote to memory of 4620 2824 explorhe.exe 91 PID 2824 wrote to memory of 5068 2824 explorhe.exe 96 PID 2824 wrote to memory of 5068 2824 explorhe.exe 96 PID 2824 wrote to memory of 5068 2824 explorhe.exe 96 PID 2824 wrote to memory of 4648 2824 explorhe.exe 100 PID 2824 wrote to memory of 4648 2824 explorhe.exe 100 PID 2824 wrote to memory of 1712 2824 explorhe.exe 101 PID 2824 wrote to memory of 1712 2824 explorhe.exe 101 PID 2824 wrote to memory of 1712 2824 explorhe.exe 101 PID 1712 wrote to memory of 652 1712 latestrocki.exe 102 PID 1712 wrote to memory of 652 1712 latestrocki.exe 102 PID 1712 wrote to memory of 652 1712 latestrocki.exe 102 PID 1712 wrote to memory of 4068 1712 latestrocki.exe 103 PID 1712 wrote to memory of 4068 1712 latestrocki.exe 103 PID 1712 wrote to memory of 4068 1712 latestrocki.exe 103 PID 1712 wrote to memory of 4088 1712 latestrocki.exe 104 PID 1712 wrote to memory of 4088 1712 latestrocki.exe 104 PID 1712 wrote to memory of 4088 1712 latestrocki.exe 104 PID 1712 wrote to memory of 4776 1712 latestrocki.exe 106 PID 1712 wrote to memory of 4776 1712 latestrocki.exe 106 PID 652 wrote to memory of 4276 652 InstallSetup7.exe 105 PID 652 wrote to memory of 4276 652 InstallSetup7.exe 105 PID 652 wrote to memory of 4276 652 InstallSetup7.exe 105 PID 652 wrote to memory of 2088 652 InstallSetup7.exe 107 PID 652 wrote to memory of 2088 652 InstallSetup7.exe 107 PID 652 wrote to memory of 2088 652 InstallSetup7.exe 107 PID 4276 wrote to memory of 3244 4276 BroomSetup.exe 110 PID 4276 wrote to memory of 3244 4276 BroomSetup.exe 110 PID 4276 wrote to memory of 3244 4276 BroomSetup.exe 110 PID 3244 wrote to memory of 4104 3244 cmd.exe 112 PID 3244 wrote to memory of 4104 3244 cmd.exe 112 PID 3244 wrote to memory of 4104 3244 cmd.exe 112 PID 3244 wrote to memory of 4900 3244 cmd.exe 113 PID 3244 wrote to memory of 4900 3244 cmd.exe 113 PID 3244 wrote to memory of 4900 3244 cmd.exe 113 PID 2824 wrote to memory of 2732 2824 explorhe.exe 114 PID 2824 wrote to memory of 2732 2824 explorhe.exe 114 PID 2824 wrote to memory of 2732 2824 explorhe.exe 114 PID 3408 wrote to memory of 208 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 155 PID 3408 wrote to memory of 208 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 155 PID 3408 wrote to memory of 208 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 155 PID 3408 wrote to memory of 616 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 125 PID 3408 wrote to memory of 616 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 125 PID 616 wrote to memory of 1036 616 cmd.exe 124 PID 616 wrote to memory of 1036 616 cmd.exe 124 PID 3408 wrote to memory of 4764 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 127 PID 3408 wrote to memory of 4764 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 127 PID 3408 wrote to memory of 4764 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 127 PID 2088 wrote to memory of 3936 2088 nstA961.tmp 132 PID 2088 wrote to memory of 3936 2088 nstA961.tmp 132 PID 2088 wrote to memory of 3936 2088 nstA961.tmp 132 PID 3936 wrote to memory of 2680 3936 cmd.exe 130 PID 3936 wrote to memory of 2680 3936 cmd.exe 130 PID 3936 wrote to memory of 2680 3936 cmd.exe 130 PID 3408 wrote to memory of 4848 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 134 PID 3408 wrote to memory of 4848 3408 31839b57a4f11171d6abc8bbc4451ee4.exe 134 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe"C:\Users\Admin\AppData\Local\Temp\2412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F3⤵
- Creates scheduled task(s)
PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\1000392001\livak.exe"C:\Users\Admin\AppData\Local\Temp\1000392001\livak.exe"3⤵
- Executes dropped EXE
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\1000434001\zonak.exe"C:\Users\Admin\AppData\Local\Temp\1000434001\zonak.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\1000441001\SetupPowerGREPDemo.exe"C:\Users\Admin\AppData\Local\Temp\1000441001\SetupPowerGREPDemo.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe4⤵PID:3720
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000447001\latestrocki.exe"C:\Users\Admin\AppData\Local\Temp\1000447001\latestrocki.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\chcp.comchcp 12517⤵PID:4104
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
PID:4900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nstA961.tmpC:\Users\Admin\AppData\Local\Temp\nstA961.tmp5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 24486⤵
- Program crash
PID:1592
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nstA961.tmp" & del "C:\ProgramData\*.dll"" & exit6⤵
- Suspicious use of WriteProcessMemory
PID:3936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4068
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
- Suspicious use of WriteProcessMemory
PID:616
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Blocklisted process makes network request
- Creates scheduled task(s)
PID:4116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵PID:4576
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Modifies data under HKEY_USERS
PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵PID:964
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:4956
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵PID:1312
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵PID:3528
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
PID:2416
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 8245⤵
- Program crash
PID:580
-
-
-
C:\Users\Admin\AppData\Local\Temp\rty25.exe"C:\Users\Admin\AppData\Local\Temp\rty25.exe"4⤵
- Executes dropped EXE
PID:4776
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4088 -ip 40881⤵PID:3312
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
PID:1036
-
C:\Windows\SysWOW64\timeout.exetimeout /t 51⤵
- Delays execution with timeout.exe
PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2088 -ip 20881⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2313.exeC:\Users\Admin\AppData\Local\Temp\2313.exe1⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3D72.exeC:\Users\Admin\AppData\Local\Temp\3D72.exe1⤵PID:4100
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a2e8367f-baf6-4349-a1a2-90d173effe85" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\3D72.exe"C:\Users\Admin\AppData\Local\Temp\3D72.exe" --Admin IsNotAutoStart IsNotTask2⤵PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\3D72.exeC:\Users\Admin\AppData\Local\Temp\3D72.exe1⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\3D72.exe"C:\Users\Admin\AppData\Local\Temp\3D72.exe" --Admin IsNotAutoStart IsNotTask1⤵PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 5682⤵
- Program crash
PID:1012
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:3348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3584 -ip 35841⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\585E.exeC:\Users\Admin\AppData\Local\Temp\585E.exe1⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6C06.exeC:\Users\Admin\AppData\Local\Temp\6C06.exe1⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6C06.exeC:\Users\Admin\AppData\Local\Temp\6C06.exe2⤵PID:1072
-
-
C:\Users\Admin\AppData\Local\Temp\7C15.exeC:\Users\Admin\AppData\Local\Temp\7C15.exe1⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\8EE2.exeC:\Users\Admin\AppData\Local\Temp\8EE2.exe1⤵PID:4888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\E938.exeC:\Users\Admin\AppData\Local\Temp\E938.exe1⤵PID:732
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3204
-
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵PID:4808
-
C:\Users\Admin\AppData\Local\IdentityReference\lqcnh\HostFile.exeC:\Users\Admin\AppData\Local\IdentityReference\lqcnh\HostFile.exe1⤵PID:3756
-
C:\Users\Admin\AppData\Local\IdentityReference\lqcnh\HostFile.exeC:\Users\Admin\AppData\Local\IdentityReference\lqcnh\HostFile.exe2⤵PID:4940
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵PID:4024
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
Filesize
1KB
MD5b8916f445195adf0ccd5396d55a4e005
SHA15ca47e0ed1a8ae5e39baa4565fa8fe50d6b7251a
SHA256e3710bfe6fbebcc17d70424f3e6ab5684a5b2856382fecb3a5a6690a9f33039f
SHA512002014a5b1e2fbd0076782df2125be42d41eb0a1d8241ccfbbd7a0819d0205813053aedfa60854f8d90553bc098e6fb0d88a6e8b32859ba87243fbc9411f44bc
-
Filesize
40KB
MD52de5ec841d41cd3156992d98ce639fe1
SHA12211ef34f2a034bbb5215ea8e1b949e4170cea98
SHA256e8e82a68d35496db4ea8becd3c9863722cab4eb037c53f526dcd23c90309728c
SHA512b42db1951b8f7a076feb8d7e8021f9e9e5b53a15a1fcd04183eef2d4a81730d024b9dde48608d7d188f81f203b6eb21ffd10c5998e1e0d41abd2155c8254ebe8
-
Filesize
1KB
MD59f5d0107d96d176b1ffcd5c7e7a42dc9
SHA1de83788e2f18629555c42a3e6fada12f70457141
SHA256d0630b8466cebaaf92533826f6547b6f36a3c480848dc38d650acd52b522a097
SHA51286cfaa3327b59a976ddd4a5915f3fe8c938481344fcbd10e7533b4c5003673d078756e62435940471658a03504c3bc30603204d6a133727a3f36c96d08714c61
-
Filesize
1.2MB
MD5e48d3e37336fab75d0fb115a6a711fbf
SHA1d5dffe199582f4a89cf561e28148f4673d37d97d
SHA256aff89603896598a4aa9042ce200761b2a20a4caafce0bcdf2b3faf026b0f9863
SHA512b83044b07f066fd580bc6a2a5508883fcb9f3fb1a7147de10a8bc80a062dd5f55814477299a7b9fed0c883f76198261e9dbd45867037058b7cf00f04b6d24cdf
-
Filesize
1.4MB
MD5f1a54bc2cf7e539e9d56f96576f1c75b
SHA1dac9e61e5ec94cf1571c6b4013a9f447b8727313
SHA256537cd5255745990b6601d016cb4565543d24b883b2938646f116a4be2be7365e
SHA5122adabf6a7750c9babc16e9f7db9f5616861052a7b4496c6f6f24fa42380d30fbb3eb72d1fb8b18256816261bb5b7301931779f3fe5ae1e93c1db3cf935342f2c
-
Filesize
1.4MB
MD588a7e632dd0c3ebb08d5bfa1c3595481
SHA18597d619d8ef0ded1948f7c07d997e50cd082e91
SHA2560786978f74f11a7871272ed717e1d988a93bee13b76a796b07a6f34d5181a136
SHA512003312bc2a69574af2577736f53a5a66d0816602b3ed51365cba92ce975f9dc4661571f05c9e8499a711be02524f2153f148cc37b748fb4978cfc2961981b83c
-
Filesize
934KB
MD581d5c68a750a06c1ac9a6a30ffa58d4f
SHA168a988f7f937a65cd53b3c09f288d9de7f0afcac
SHA256852a12785667107725ac170c9d82358281a58bcfafbf31b5690e96975ca87f3e
SHA512c47f640d60c84e53d7d3a00018807da465aa71af92c8e6002da8a9355c7b3ccbcfa2c4708b96827f505fe2cc16c7d5ed38c38c192df418a42ff50437485e5079
-
Filesize
1.2MB
MD5ea908c66f5efa469bd7e7a9ae20ed4d9
SHA1c6db90534545325a9630c486ac7c49cd4f3a079e
SHA256457a94abc03b137e9d75b8618f5ff377519a5c95c7c3f521fd2dd277dc90bc3e
SHA51259b808deae959801fd1d38d4776d1c3744b8600009834709c538499e4b8ed583b08b21d4861db96eaabb31c3b24b1f8dad03dda3a3f70fdfe785f663d4cf7390
-
Filesize
1.1MB
MD538f7eafa11b3983d023b8e44709f2fcc
SHA17dbea02740ba92c0808267e6e660fdb8ee34a06a
SHA256d974420dfdb9635f2d7c119989f716ad7f1b4b8b61d203c9b0ff9de5bae56b35
SHA512d208238868c5be4e375b33d92d07a5b84b6cb352b701548a2876edbe8fdab87fbbd7dcc09f7c416a6b97af94a5c2df5c56ed523aaf9f6ec3943e062c389eda29
-
Filesize
4.9MB
MD56822e7b52470be13bb2e4f61bc893736
SHA15ae7d86ab1f517b192bcc4ab3c98e037d7519fba
SHA2566f203dc774370a6ee8c35eab2446490062d0913600851529c2cd2832b53f9def
SHA5129b5e6ca70557a0925a23c37e452034fb862a1c716a56c2f64b5248660d06412484c700599ae8cac85aad2deb7494ac27328983a1397b9630d582e0967e489e38
-
Filesize
2.4MB
MD5ccbe29b48438563595ea976d31c6c22a
SHA1863660f5ede75a7281b369c5ebb6d936ae475d33
SHA25604f05c0f09f7228d0334b7b85e7bcc41d14d10ab285400624d8f3c9701c48157
SHA5123be5286e4c07afd59ed5182f6a2a02462ffb4a5b36f31d799f3fad5a576b589d3a78d8c466f800f413c508d6c8bf6c52764f55b379b2a0f783a2dde5852209ff
-
Filesize
1.3MB
MD5237c3a47e0a8c8ec9baa082a53a08152
SHA1f096af41a23525858881df8c74d4440c4df7eb08
SHA256fc8207494635781e75a8fd8e05a348202443cb7f5cc5770e72f40417972b3110
SHA512f12ec9846e4c757d836211417711781d94cb4d2f1f3270ee957897b49d39129cb7457e065447ca0496039046c04b16d594d129a5f10a1faa06990bf13899c5fd
-
Filesize
550KB
MD56b8739c13a1ff2b4699ce2ea5e5eeefd
SHA15514f621a218b625e573b313b94d1c61c9297f85
SHA2568a96a3decd58eeb4fdbfe1d2726eb5842041cfaad3e865c9e5b5f41f98e4cd12
SHA5121aedee2574b81bda47f858a8fc094f3271ef5bee395b75e527303a5b4798877456f6f09946ebb8ac70dbb79a2b0b6f633d2b1613c95e4c1bb942dababb2fe517
-
Filesize
541KB
MD5fe61047c926a426bf54579d6e0df7913
SHA107331a2a55e0604c24808544b4b36cceaea739ae
SHA256ac8bc3dbe0f54df6e0933a010d014250232c4b42e3b5aa7573568737f5c8a2ac
SHA512cff61e733820bdc90e58c895f2e98baa1948a1a7c6d89ce51b83ee1c3bab2c4dd525bd6649c78b0e46e026f950805574f55ed000670fdaed3535976b3e5d9e87
-
Filesize
1.1MB
MD5fed838cf366ca2b35ad297d43a7a2e24
SHA11e71188e411b9ee20124c273d843fcb6b21d05d9
SHA256e316cd66d0410b6b53eb7f717ed8d410bad5065a0d58e6e10a8ed9578ff849a2
SHA5124e4159a29284a7c8d5bb1a5ef844524acdc5ffacb2fb49655949391e76001a658e4f00559ea5b936df7af620f192e99358284be5ce1920ad505dbc6bf9e1bfe5
-
Filesize
7KB
MD5c72ae097bc9d2737e20046b0610b9fab
SHA13087154a1d4752afc6cd1043ffed6f9203ad324e
SHA256a8a284f377cb9f21c53e5553234ecb693dc4c2c38f3306b6cde4aead5e05e913
SHA5126225e27319d828ae7aadf011a959a5b1b67cffdd1bedbbaed2a53bd3fd71457ed872016dcb17bfd1ba713e324c7fe4b3076923eacd067052cad28f038bd831fb
-
Filesize
272KB
MD51b34541fb0dc55293424cd982f09cb30
SHA16e27e8c899d92da67fdb5b6f07b3d3ef54dcf62b
SHA256c1a94b4836ce341261dafddcdd0b7f2fb0d8974418cfe37bfe4edac452966dcf
SHA512ca39dbca5ae9771feba001fc6aecb8dfd32e4c78be53c14af092b49e7277d8575833fa65ff5f7b06809f1733215892c1506dcbd968376f97ea18f0d5313d10d8
-
Filesize
79KB
MD5e18d7e8edd216ec0959dc0fc3ae6afc0
SHA1992e368839da8c14d62f362fd05cff35fc5a57e8
SHA256b606d2c696c41ad0ff775ebeab26c21e0de78277ca0d3b19ea3c4b3fe1c9d64e
SHA5129bb323056390ccae42d04cfd3b73930326c3c03ad956e34d1fbc4aa246780794176bb3c545ee7fed9a3a4c2b297047525f3ad58285d4373d628ebe2fc997c8ab
-
Filesize
295KB
MD53325270313f072334662935e85196535
SHA1bfd2d5a01c98fb026b1dcde6d04d4b2d91359856
SHA256a321865e34888c8cf6a0112d52e649681d457fa73f91bf8b54eb3a2dfebff27d
SHA5126cb0773659a4d5e80b8c7134829a425d07278cb3515d1a8b4a7390b9162ce612e08008f4283c02f2bed6a7bd733e1ece9d26d02cba527214c0ba8c194fc1f9c4
-
Filesize
15KB
MD59f71920f7c63f2b8896e9805fc86f87a
SHA1a063798c75a63a38100d56360f2d4aba6186533f
SHA256727dc3a82592264516719a8a8560d31b9dbcd43f74c1eb66c26486db2687b343
SHA512ba18c97b0eb2506fd2385c80f9623105a65adaf4bfb13a13883eab5b686a9e9f073a43aacbee9340a1f1f835e068c028490ef51e620b3f3c649000690b76c504
-
Filesize
147KB
MD500fb16c8bb4e75a586e3bf67cb641924
SHA1a9fde59212c0890ebef702c3f3dc34d7986f8676
SHA256aa08250f51b77675389c7128b8f0739a9e59b9abefbcef85d5d5efaaf16c716a
SHA512e167500a97ffbf3ccb8e310ae324ef4164fc720453f29a2a9ef74f33711c94ae413506940e799d14b1ef2799e885e09f68186615ab1ddc93b9608ef9a486634e
-
Filesize
55KB
MD544fa2a72e4b39327a46a9299a27368a7
SHA1b578d91a80a7b7da67038758601b360912d9fd47
SHA256ebdfae7502b338e809898467d74890fe4945b89b6821c14037d2c39ca1ed70d1
SHA512e4ffb466fa4cf8ba3c0383c175e517e61a29e3484b23871b2337c003ef76b3663769e1e7104021e91d8803700d88bdaacd1bed86dffdf3ef3c4666eeb8924108
-
Filesize
164KB
MD523a4b31b1b37dad2155e8a69f6556872
SHA1f94cf3a7ac9346c723af6c3fe6723e081a531cc7
SHA2565256abdba18da45286b493b63e6fc04d655143265c2cea9a9f20d0af5e3eff37
SHA512bb1c60795329114a9f32fc7820c1fb4a10adf5b1042aea6c6ad151b9b88bacf3b391aa89d401a348edb8bf3c588f8bd428bb53e10caec38f4e9dc5603548f3e9
-
Filesize
24KB
MD5a8d71cf91a6e0cafc6a1e60989069bc3
SHA164c0c1f454de0b16d7690f36ae513aa47fcd678e
SHA256f05a6faff3380c16e9004adaa500c6aed5d9384c5f39e8487bdd8e4dd07a36a9
SHA5120827195001c3a7e17987cb6d85713e96846acbfc275b9b6a2f40c588722f9be9ab2470f7ce366238151dd83db971ce9b22f512ffa814a7417c3892e4dc738f1d
-
Filesize
144KB
MD5b269689601a0846a77fe36a237f16b81
SHA16f358cde43973c74a34a3e0df0ae4882a025832c
SHA256cc9363a398bf1e66fc8866cb11238416f9e31c54f2a7315c84dc68101335e805
SHA512ed53fd34be79ecf0a7493fefdb025bdc2283fe90a0f79abefba704e855f4bd5a4f81365b3e4778e31024dc846fdb135a2b1045c669073cf2da32d5bdb1648680
-
Filesize
53KB
MD5b80d13b9842efd0681612f16875eefac
SHA1462d7ebe8480a64cb1139cb29822b4f9c4e034ee
SHA2566c289ea74807aafe85a84861abb4d7c95d3ee3fa3229c9c72b2b588589f07a44
SHA512b58de4b0711103fc922db9ddf22f3aba8905dec0243b2edde07c0e001fb68e300d30122fa4acfc9dfdba4ea6854a7d789ae2129090b9fbbca98281b314734b16
-
Filesize
47KB
MD54fb3ae3aaa6a8bccaf5bb7178cf97204
SHA1a281c33e9b5fa806a651ca8f8b345d4dfe1a1dc4
SHA2567c34928ad0b3c4fe2c0206d79cc948b74aa81679a93de66bfe63d068b2888602
SHA512c252daab4725a996332c04bcaa0fe79f9be95494bc98361bb40a1e2df7f95d4152dd23553ddbcc39e73841e4afd6d2066496952acb64002d1abf5fdd3500bcfd
-
Filesize
127KB
MD5150ad9784f671abf1ba4b5f920ceee4a
SHA1b0380173aa9f97786a7b44ca1a2a6eea6667bf2e
SHA256144f356064122ef9842a83a900b32ed1f3e1058f53280615491d4101daa7786d
SHA51201dce6c16ca45a99d139f615d00b7463e7ba6360d7b0df5c13acb331bc7114df6ca4b2b523f86933c356447d201b9fe737076a115d1ac12e686f1a899421ec51
-
Filesize
403KB
MD54c8cb7563ef5657d243b12cd196cf999
SHA144b23de01b1912971d443ac0c1f9886119b1369e
SHA25688b7fefbb7cb8f3ee21d123a83d4a4d3b080624c137acbe2fa3cfa6e12ac044f
SHA5120bb2c5538cec35d719288eb3ab77e50d8f6d4649c17e0e769dc49b6a24c0a24a2672ba351a6d3792c1179041b851c3f56fe1821fc7131d1dea2c738d6997f956
-
Filesize
57KB
MD5c9e5ed94f3cf1f4609088a7ef923c02b
SHA12b65b04a6b9bdc5d3cdfe0df4f38ab28a2cd26ce
SHA256c7cb485adefdf31e9e2b4c5200e0220b1b40acb77ee9a4429c06f3f8210f0f32
SHA5121b1d93e46b4c5894a67747e4137933a5b96b3ee154b4b9b05123a16378fffe5f4e8153a1ca3d72ab41a48f729158f50a88d6c0b640cdfa8ae74322dc6640cb39
-
Filesize
81KB
MD5674ee923d54dfb277e74133e989da2d6
SHA1a0fc85342475801a95a6bbdf54258889b710cfde
SHA256827713aa675b62c69d7dd673e9ce446230d0da9247b28e974b61cb5a7abc447a
SHA512a83fe8658685157dcb28cf7356f25a7456f9c264bddb25fed515f336fba0a96ab39a6f63d230dc08cfebad493ff44f32ad629a303c51231cb981ae7150acc9ff
-
Filesize
29KB
MD51fdd0131f678a1a88ada377d0465d79a
SHA1fc43551daaa8bfd46173cf4abf0c310a285e149a
SHA2563b345325445ff2506848bfc906248dbc142ede7f4f9c68f9d28d0b475fc63de7
SHA5123a2cd3a2fbe35175ced1debe748dbd3599904088e1cdfd8677c84bd569f5480a77fa2ab6f187984e066093279b0c568e47104f188d746857f3f00689004fe79f
-
Filesize
90KB
MD5775e207fa6ce01a753217e6371d02da5
SHA1b2cd970a2434585d83ca00542021cd66aaacf3ba
SHA256a224e4ac9dc1accca7590ecc9effb8cbe93753d284e9a8bf1f04d0c4c00ca630
SHA512b5786b91d4779545651936097a3cefe50373631cb95ddbcb83c5fe13bd17a8a5ebfe7088b253a5965fbe14d88ff394a093b826a65193a7b68999f3cf112b669f
-
Filesize
479KB
MD505ff111baf640b1522ded1f5756430ec
SHA144db2de7f37ee5a6c9e622f78aada0e9c7291522
SHA256fc2ee506d95e164e617a4efd8e8c01170168743fb3a656eb30d094b9bbfa084a
SHA512d7d193338a083382313c65b78e99fe9d52ffb98f19ed03dbb211180e0644e13c1d9328cf9fdf60ffec0c220b13161d27db2a2e8f21f60f07f28bf5becce64850
-
Filesize
370KB
MD5b4a89e4ec200c7e6913bb4703622fff5
SHA1356ae7a71ca46a8f22bf105574ad4b9efb4a14f8
SHA2562f9137785960e4bd9386a10d6365db76fbeabd3f56bc445f9e45f1bccc27ef0c
SHA512e128b9dff9dd28e55c4507cda6af2086c794ed62359f402094adc9ac75110a08b7610484f0f12f4646024663203c7aaa519d0717e3251574670009bd76bba778
-
Filesize
1.5MB
MD51f733cd5d76cf3cbb83c64d6f55fba40
SHA1410ef9ce65ef3182685f0b7089b60b4228beaf97
SHA256df745498beb66de29aa9efa2356e6d18e59c37e498cfaa64d130551f0f96a5cb
SHA5124acb0ab2bcde29f7b48f9c23524ac6908aa8e11da0dd50fcc0f84e59bdd8f7a3ad2e1f59e8720130d02461db1429e78ca1e5cbf900e10258fd1ff9c77a27d425
-
Filesize
157KB
MD568b3bed5378f9223b2a51bd2432d71ff
SHA1631f1b5c7d6d9d8e77f9375696494d034df5e9a9
SHA256da069ccfcd9a329b3ad7b5558964f9a37c34e8410c9ecdff5adfae1d0af21d05
SHA512995314702177b2321135c0b90659796bef30fb61ccd1796cd5e591c05f579670af15b72d0026059bf881194d7055f0106b194a358a38e22c924c03c8222fc2ef
-
Filesize
144KB
MD5ba5bd80bc23d3577c26e8a7445563aa1
SHA19b8d5f9eae7c2f50d50e1eb214d89bb41a756927
SHA256b0815ba00b9438a984ebc068ea4b43d1ba2188fd9487c2720b8dd5212ff56dda
SHA51286e0456fa67464178952a02d917f652e7938484c1226fe79dc512a0f385c4bc7ae002006d5132531043726afc4b62d505c3c0932451769fed485fbb3338f524d
-
Filesize
114KB
MD5156825d6c43654024658cad17d022405
SHA19270ca6e1f5e37313bee867779b97fd8629bd6a3
SHA25679d1510a85ac687bdde255c038693fa8d34802d7b8a7e1ccced983262ac9f7f0
SHA512f1f18730817b9c20c236cf52acdfa9129a27323c0b9358fc2e74a8365c20518a2304910707edb71ad9d414eeccd72b22e2db86df02779d5e6bf2faa401938c61
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
216KB
MD57a850581de6656873f2bc1319d608a60
SHA1aa34f6c33265eb804a89175dd5c2d80515f7aecf
SHA2562b14abfa3e51f427c00b9d12e4336e0a3c55e170fdc00a1964c9d85d82e26548
SHA5121f8dcdca80ef1b2210411f4b6fd57920b491a17a6261664138325981f1dfb4942354adae9aafebe3e2df53c89ad3da2722a137729b100a23724f6db33aa372fb
-
Filesize
1KB
MD5f2e952b54a86a6b66aed8494137dd1fa
SHA1ee03ed93f0ec28bbe7bda148692e3b08e17c0ee7
SHA2561e10a377f420c54c25c21b47a61ab37c79e1ab33f1406f57b95c316a3fc688af
SHA512953b41eb40e663c9c6febbfcedea6a5ec16bc2b733ae073852cf985061c5859c3ae402e511f34898f8a4e0f7a3d8fd5dc7a6759562a39f34a77a7bde67fbf8f7
-
Filesize
791KB
MD592e801725271ed67717bfcd1cd524eee
SHA18e30f78e231a605b2875bfed3b743bce73313093
SHA2562412d2291880ecef6a46169846845ae459aa3a7b5500be4ae1458edf572913eb
SHA5121c3b75718fe87eb74374b1d8fd6d0df7cf8e37751552775803fa703744f1e3437e40a06340630917fb450f25ac518ae888f0a866068b250afea315a47472ac98
-
Filesize
272KB
MD58d7f024a36aba3b0d38bf54b5263b47b
SHA1cfc2234f1f92ed92ed41f81d01937db9d709fc8d
SHA256a0d8d266a8f3525d3719cc65261ea9b210bb42b7cc982ef2f600d073925da415
SHA5129e52713115f0397d5a202770f0467a78bc0aa6c7dafbfce5a4a9d3ba17d60d57ae31bb55586686601d6361901d3cf86882d1b6986c3587def17cc42a0f957a60
-
Filesize
51KB
MD591e92e35a35e77f23f7416e61f0171ad
SHA11cf748a4ed079c3d2453bbcfe0b184821f944b0d
SHA256de8430d331947128e34d0cf5b18242f0fed897cb8fee24d42d659d7f4e2d38ff
SHA51210e2f69dc97549981a1240ce165aa7f6f2f49540c1d63c411bf65e0d438653813488cce6c9b992ae14734b2b114e295429445c63ad9cdd58a1414cefa546228b
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
327KB
MD5b04c009f23f0187a7ab19ee5665e6061
SHA1c028b6482a2ea0238b2c3b2c47ef3bb13e63996b
SHA25640791be03ed59ef16285934464e274cbd7d3d0fc2a44bf1b709b99191d78ec71
SHA51225919f8a268a99e21f9237ddcb93c4c3ab1b29df7e45e7ad6d3e4afc20783a9bc9baf421a0b5676ee4d0f3b2941645ebc809d459154305a8f5ada885d033919f
-
Filesize
332KB
MD55d09332b549a7afe619e17236e500067
SHA14af37770d0001aba22cd39b84d5f45c953cbf3a3
SHA25697667acb45324c8a085892b2d728c809c478ed5a6e5bed46d6b5faf40d924b62
SHA5124f8bf93d1d35748631348d89a4d6e2022a5dcd1103de9cbd89c062f98a6ca35705f29b7c772ed7848c651f7696c700f56a74e6aef3fb12ef7b10fbcd3318fbc3
-
Filesize
365KB
MD55f5b1f8a684d49626fa0ed09aa5da430
SHA14a0c9349f6aeaaeb8cdb0fd84049539be769bd9d
SHA256198929e2fe4c38e8cc47e08efbfd7d73740a15f54f984d558df2506187d449ac
SHA512a698281284d9e9948aeefcfab03f2314f2fd250ae8b0f8a3e1dd10b7ceae2988971c0f356aaccf7f44597e9d7e8ee122d8a2b150faf8b45eda29a382598d4b10
-
Filesize
95KB
MD5a06900060fbb2e7d7a1968a049623087
SHA1c6beacb59bf07b5e9d0bb453b5103678ccc1d20e
SHA25642d849cdfcbe4a5bd8998a55775056d06d705c0afc0c88af586480687d498bb5
SHA5127eb8dd7f18028bd329905bdd2def1017d18303630b1291bb4c4002cd5a8abddaee3e5eeeb130a85952323981dc1ecc0282df6051bc29a41ada34953afb77db57
-
Filesize
64KB
MD54243f44814b08e044ed46bf80af45e67
SHA1e7fc7063ba08c848a38a3ae4d12918ff940756d2
SHA256250e8026987fa724cdf834f5eeb81f6f6c12297a7f4978dc29fd1a849a4267cd
SHA5121ea47758ca08dc1afb126dac92ba3fbdda59eca339f126f24ab6f844c4910761397e80b9ef49dc70ceb38c70a88e803e618031e74f6195a97fa12d533a61feb8
-
Filesize
182KB
MD52e0d2f82386c4d1176d1ec6a40257232
SHA1e11e468ba1e9f9717e501c6fa69e15038fc463be
SHA2565209f2a149496cae9e345681d73f077e92073a8152d410095d99dc11103ed84b
SHA5129588974b06bce4f505251bd74c818892b01e3907bfb5d0a50a0967446ea66b9986efb6ed003ce448e06219d832d13903590542c6c742f8d045461a64e00f3e8e
-
Filesize
132KB
MD506ddc351caaa7cf877406e78ee45f4c1
SHA17e9985169c01e3cf99e0b04d81cf4f8563ca94bb
SHA2566e2c25c03e7a055ffda1790cadd64f5ff224f872726624e13ffd5e6726ccd507
SHA512ac6ed6d99fb6c835fad0dfa1f21c2c25fbc5204b23b3c82c2f2ce8d62eee08ce96c39e8d90a2bf71ff44f0ee2bf053f0b51ba2026ca4936466b634b18b2a2962
-
Filesize
102KB
MD585af6c99d918757171d2d280e5ac61ef
SHA1ba1426d0ecf89825f690adad0a9f3c8c528ed48e
SHA256150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e
SHA51212c061d8ff87cdd3b1f26b84748396e4f56fc1429152e418988e042bc5362df96a2f2c17bcf826d17a8bae9045ee3ba0c063fb565d75c604e47009ff442e8c8e
-
Filesize
76KB
MD506569851c63da780067989e960e96ad9
SHA19bb4a23865cc0c462c19781a2afdd906875e8a99
SHA2561c1b3c3b69d343de090fc11eda074cc431c9e4c6e3cfe1aca132002a0cea1305
SHA5125fc9650b76bd3ff7eaf31f593bca10dbe2a3830f88580e1f988b7cbc3ad11389996fc48220e5395a418bb24eab8f4331ea8f53109625b36393d9ab8337657ad3
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5634eedf12ffb9f0886e8555ffdeff738
SHA1e5191bf21739842756e59c67f44dd38bf027a0b4
SHA256ea19dd5f4bb5f980d1cc67369958b1664c3f34afa845d548c086aaccc2b19069
SHA51253cd128789965ee1edb081dba4352e6e51cdcb2255da84b600964d607aac752257c04bbbb35763d997f3ab5242a9f51f56cf3159fa37d942b0e753332fa9017c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a2536925bb8401b3c1c7a32dcad8e0ca
SHA1e2d588327afe75213407ff41cb587d8f45c5a47f
SHA256b2b437db3fe0f289df0cac16b1b63a733db4234f45e6621a3e70dafadb40a1c4
SHA5120447b2f6ba6d85369316a0aba40b3935e7524e6c0535da63c2281010611eafc7f8c2da68ccff39810c4e3e4534af0b3dbfa9cc9c035f8aa250c8792a84016f0f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD548603e3f80876bb55f7a063003fa08fc
SHA17cb0d86baa54662d8d15c20e1b529cd4640d85e3
SHA256892a5ee4ae29bb05ea7b2d8a454dbe930f830e2cee284c59a32374909b6c8bfc
SHA512f33b664a8701de8e86dc81466f8f38069eb7896a402129a5c4ddd2d03d7737a0e08f65e333b59611f828ac23c5ab383fd41a1262d3d3a3121d526757dedb7a8b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58d234cde48b7b7c59ae8b7d1e20d7fec
SHA11f185de0e62c38d7fd3db2140a569c5c4156018e
SHA2567c2854c95c402b59ebaa670d552ee4a23cbe395d66f1b132523ce0e1152b6bff
SHA512bc9f5177257a127c9268cc8bc9baafe75b23045f54d024285126687025ddc6cb4bd3e5f4d532bd2ce354692059c96b7ccd6580c1defcf3a0973632664c1ff812
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a507b10bed45cee6fe5071c03bdeec17
SHA1f7d904c743c03954e0ed0a7245c230546d375813
SHA25623c473ae132609de46dc2ac8632d128c8af51635eb119e2f7826286578a05087
SHA51224cc077b9fe5133fde43afafb9683855eb203d91e5532281c47aa74bd2cd5a0d21d67949169d771d05f4e5d9ff95322864a35b3ea8874040e58a1a01d2051313
-
Filesize
94KB
MD512269bd57351a21cd077902a6ca00abd
SHA160e4a12a34dcc4c73624398a5011dd69366a1979
SHA256637f436efe91eb2a995c03fa82237a1f7829b5653c698433dbca61dd7f638400
SHA51272f5fae308aa265631f3eee844219d1dccf0e5ce649e781671787ba11f75debba559703a7045e60c367f69619477992e4381aa908840f3c9947d9cb95cf943e8
-
Filesize
94KB
MD57a0a9e58bd30866005a4f207f8eed05d
SHA1cb49a993e1d73247344c38c3ac0bb13e7f5d0497
SHA256045ebf48a714ed55aaea22243947936bb649174f3a1a493b26a803240593d73f
SHA512bc5cb8365f18cd4b1f09e2dac72ce2fa995d40cb18d750f02596f8aa0012b8d7f0b0bbe63ec128ee3f5abb0cbd01f80cf3b1b74356260041109202d2706f55bc
-
Filesize
50KB
MD5c836f57a253bdc58316caf1e60ace400
SHA171d925de178570b1b3b2f7d91f257a9ec4370d8b
SHA2569956dd473ab7e2a353818b789585af8fec4af5d7dca59853e3915a1b18e3b9a6
SHA512ec1b300afe1b1d176036ba7567d26eee3417b4530cd936eacb81a70049e6ebd9a5b61364d7a86e0089521eba7bc17171d039a763c10be53f00261a2e0c1b9e47
-
Filesize
34KB
MD5ab0d897871ed756c86266908320289c3
SHA19d85b4b33e0180697dec5dbf9988741595636997
SHA25669e90c9300e521206a3a79a5d1beebdbd03cb073d1683d86fc18c397dcecb77d
SHA512267413d1f85abe7c852f1f009f19c26e016b2c08cde40c57a8cf765914634ecdb5b53980803c13f58f3bd1d62cf894aeff5df044651e7efb7c3dc4808f00bc10
-
Filesize
52KB
MD556fbe372d12638ac2a81eb7691baa818
SHA18da16b5bb24d32e899ec2efa69d70b3abc32a28e
SHA256a65c540246cada295a4c915589c39a2a127954b083b41d4ff27269be48f0be91
SHA512a5f98b4e6da72165f44049a9af7a858b9f7db2be523f8ed47cbc6eaffd723aa597000e267c629cf0fa22a01bbc98f097f5431bc44bc8a07db7ae4acb523772bb
-
Filesize
14B
MD5e89ac1f7b3083ec3c93283ec05fecf79
SHA1489b25a1a12157a6b3ce503b091feee61522ffc5
SHA25660a8cdd10cb25eef274723b0c24b5d140a5ef2402455f7a03dc44844b867dbde
SHA5121c498b1b8733fe257e1c57e1b89641909af085b35a3becfc9893616205e9d3efce9e14345a3080b0d3b75bfff97bd36ecc819126b511088ab10476fb77ca7187