glupteba | 5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f

Analysis

max time kernel
65s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-05-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
Size

389KB
MD5

b8974e005f6850373862db8ec43c739d
SHA1

da18ff2135677c6e6ec438fd5a3cc86f274b2072
SHA256

5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f
SHA512

79d002d26fabbcf9807d7b4ceec0244b27a192601f4c654438324153a258dff165925cca6d882a297240d335e935cda0dab25af67666596bc7142f1ef4ace385
SSDEEP

6144:VoavxgYvX2ZXThTtP8KVa2txCbPhou247E/VnX+Q2EVGxm5mwhQ4bkSp:VoaJgnXTpR8KVatbV8OEIralJ

Score

10^/10

glupteba stealc zgrat dropper evasion execution loader rat stealer trojan upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/5168-1478-0x00000206720E0000-0x0000020675914000-memory.dmp	family_zgrat_v1
behavioral2/memory/5168-1685-0x00000206781F0000-0x00000206782FA000-memory.dmp	family_zgrat_v1
behavioral2/memory/5168-1689-0x0000020677F90000-0x0000020677FB4000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 39 IoCs

resource	yara_rule
behavioral2/memory/3824-305-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3852-331-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3676-329-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/2344-330-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3824-1248-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3676-1249-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3676-1267-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3852-1268-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/2344-1269-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/3824-1270-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-1368-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-1375-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-1376-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5540-1374-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-2263-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5540-2264-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-2266-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-2265-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-2516-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5540-2517-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-2521-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-2520-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-3740-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5540-3746-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-3749-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-3750-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5540-4012-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-4084-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-4085-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-4086-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5652-4087-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5532-4194-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5524-4233-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4505-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4961-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4973-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4976-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4979-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/6064-4982-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
376	powershell.exe
2320	powershell.exe
5972	powershell.exe
2092	powershell.exe
5848	powershell.exe
5948	powershell.exe
4800	powershell.exe
2316	powershell.exe
4280	powershell.exe
4312	powershell.exe
5928	powershell.exe
2104	powershell.exe
4392	powershell.exe
1036	powershell.exe
3428	powershell.exe
2720	powershell.exe
3884	powershell.exe
5704	powershell.exe
5096	powershell.exe
4480	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5840	netsh.exe
1592	netsh.exe
1112	netsh.exe
5140	netsh.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YdePAYGQZUV9nYogMvK8v4zd.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnpdDareoBTz7xZHoc1NxBaI.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nKfqDWX6Pg7p2uHNpxAFKAlp.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GK6EaDkPkhcNDGTIYVuh683x.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IOT11e55esdAwssXyOtUBxCQ.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87Iv1RuizSOQtlS9b4l6fdRc.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aqoAfD7hGJj1VsuWAC4gWxxa.bat	regsvcs.exe

Executes dropped EXE 11 IoCs

pid	Process
4380	VVaDuqieiq9TWRq0IFjiFFu3.exe
3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe
3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe
2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
3852	gMKTuD6m3oGmvt9msdk8SHZT.exe
4164	u3do.0.exe
1488	u3do.1.exe
5652	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe
5524	gMKTuD6m3oGmvt9msdk8SHZT.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000001ab9c-4965.dat	upx
behavioral2/memory/4156-4975-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4156-4981-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	3Akm9jHwqPWAdNMfOFGZ18g1.exe
File opened (read-only)	\??\VBoxMiniRdrDN	yF9LasH0TlQy9jPwMQ5ufQPr.exe
File opened (read-only)	\??\VBoxMiniRdrDN	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
File opened (read-only)	\??\VBoxMiniRdrDN	gMKTuD6m3oGmvt9msdk8SHZT.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6136	4164	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3do.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3do.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3do.1.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5840	schtasks.exe
5864	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	yF9LasH0TlQy9jPwMQ5ufQPr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
4280	powershell.exe
4280	powershell.exe
2720	powershell.exe
2720	powershell.exe
3428	powershell.exe
3428	powershell.exe
4312	powershell.exe
4312	powershell.exe
4280	powershell.exe
2720	powershell.exe
3428	powershell.exe
4312	powershell.exe
4280	powershell.exe
2720	powershell.exe
3428	powershell.exe
4312	powershell.exe
3852	gMKTuD6m3oGmvt9msdk8SHZT.exe
3852	gMKTuD6m3oGmvt9msdk8SHZT.exe
3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe
3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe
3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe
3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe
2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
5848	powershell.exe
5848	powershell.exe
5928	powershell.exe
5928	powershell.exe
5948	powershell.exe
5948	powershell.exe
5848	powershell.exe
2104	powershell.exe
2104	powershell.exe
5928	powershell.exe
5948	powershell.exe
2104	powershell.exe
5848	powershell.exe
2104	powershell.exe
5948	powershell.exe
5928	powershell.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe
5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe
5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe
5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe
5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	5100	regsvcs.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3852	gMKTuD6m3oGmvt9msdk8SHZT.exe
Token: SeDebugPrivilege	3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe
Token: SeImpersonatePrivilege	3852	gMKTuD6m3oGmvt9msdk8SHZT.exe
Token: SeDebugPrivilege	3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Token: SeDebugPrivilege	2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
Token: SeImpersonatePrivilege	3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe
Token: SeImpersonatePrivilege	3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe
Token: SeImpersonatePrivilege	2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	5168	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe
1488	u3do.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4480	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	73
PID 4760 wrote to memory of 4480	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	73
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 4760 wrote to memory of 5100	4760	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe	75
PID 5100 wrote to memory of 4380	5100	regsvcs.exe	97
PID 5100 wrote to memory of 4380	5100	regsvcs.exe	97
PID 5100 wrote to memory of 4380	5100	regsvcs.exe	97
PID 5100 wrote to memory of 3824	5100	regsvcs.exe	80
PID 5100 wrote to memory of 3824	5100	regsvcs.exe	80
PID 5100 wrote to memory of 3824	5100	regsvcs.exe	80
PID 5100 wrote to memory of 3676	5100	regsvcs.exe	81
PID 5100 wrote to memory of 3676	5100	regsvcs.exe	81
PID 5100 wrote to memory of 3676	5100	regsvcs.exe	81
PID 5100 wrote to memory of 2344	5100	regsvcs.exe	82
PID 5100 wrote to memory of 2344	5100	regsvcs.exe	82
PID 5100 wrote to memory of 2344	5100	regsvcs.exe	82
PID 5100 wrote to memory of 3852	5100	regsvcs.exe	83
PID 5100 wrote to memory of 3852	5100	regsvcs.exe	83
PID 5100 wrote to memory of 3852	5100	regsvcs.exe	83
PID 4380 wrote to memory of 4164	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	84
PID 4380 wrote to memory of 4164	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	84
PID 4380 wrote to memory of 4164	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	84
PID 3824 wrote to memory of 3428	3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe	88
PID 2344 wrote to memory of 2720	2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	87
PID 2344 wrote to memory of 2720	2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	87
PID 3824 wrote to memory of 3428	3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe	88
PID 2344 wrote to memory of 2720	2344	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	87
PID 3824 wrote to memory of 3428	3824	3Akm9jHwqPWAdNMfOFGZ18g1.exe	88
PID 3852 wrote to memory of 4312	3852	gMKTuD6m3oGmvt9msdk8SHZT.exe	89
PID 3852 wrote to memory of 4312	3852	gMKTuD6m3oGmvt9msdk8SHZT.exe	89
PID 3852 wrote to memory of 4312	3852	gMKTuD6m3oGmvt9msdk8SHZT.exe	89
PID 3676 wrote to memory of 4280	3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe	90
PID 3676 wrote to memory of 4280	3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe	90
PID 3676 wrote to memory of 4280	3676	yF9LasH0TlQy9jPwMQ5ufQPr.exe	90
PID 4380 wrote to memory of 1488	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	95
PID 4380 wrote to memory of 1488	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	95
PID 4380 wrote to memory of 1488	4380	VVaDuqieiq9TWRq0IFjiFFu3.exe	95
PID 5540 wrote to memory of 5848	5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe	104
PID 5540 wrote to memory of 5848	5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe	104
PID 5540 wrote to memory of 5848	5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe	104
PID 5652 wrote to memory of 5928	5652	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	106
PID 5652 wrote to memory of 5928	5652	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	106
PID 5652 wrote to memory of 5928	5652	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	106
PID 5532 wrote to memory of 5948	5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe	108
PID 5532 wrote to memory of 5948	5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe	108
PID 5532 wrote to memory of 5948	5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe	108
PID 5524 wrote to memory of 2104	5524	gMKTuD6m3oGmvt9msdk8SHZT.exe	110
PID 5524 wrote to memory of 2104	5524	gMKTuD6m3oGmvt9msdk8SHZT.exe	110
PID 5524 wrote to memory of 2104	5524	gMKTuD6m3oGmvt9msdk8SHZT.exe	110
PID 1488 wrote to memory of 5168	1488	u3do.1.exe	112
PID 1488 wrote to memory of 5168	1488	u3do.1.exe	112
PID 5540 wrote to memory of 456	5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe	113
PID 5540 wrote to memory of 456	5540	3Akm9jHwqPWAdNMfOFGZ18g1.exe	113
PID 5532 wrote to memory of 4348	5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe	115
PID 5532 wrote to memory of 4348	5532	yF9LasH0TlQy9jPwMQ5ufQPr.exe	115
PID 456 wrote to memory of 5140	456	cmd.exe	117
PID 456 wrote to memory of 5140	456	cmd.exe	117
PID 5652 wrote to memory of 2840	5652	vJJ3jEPCxuhlMXe5Sf7NfOCA.exe	118

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe

C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
"C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\Pictures\VVaDuqieiq9TWRq0IFjiFFu3.exe
    "C:\Users\Admin\Pictures\VVaDuqieiq9TWRq0IFjiFFu3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\u3do.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3do.0.exe"
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1068
        5⤵
        Program crash
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\u3do.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u3do.1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
- - C:\Users\Admin\Pictures\3Akm9jHwqPWAdNMfOFGZ18g1.exe
    "C:\Users\Admin\Pictures\3Akm9jHwqPWAdNMfOFGZ18g1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3428
  - - C:\Users\Admin\Pictures\3Akm9jHwqPWAdNMfOFGZ18g1.exe
      "C:\Users\Admin\Pictures\3Akm9jHwqPWAdNMfOFGZ18g1.exe"
      4⤵
      Executes dropped EXE
      Checks for VirtualBox DLLs, possible anti-VM trick
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5848
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:456
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5140
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5972
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:6064
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2092
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5840
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4028
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3884
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:5636
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5864
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:5016
- - C:\Users\Admin\Pictures\yF9LasH0TlQy9jPwMQ5ufQPr.exe
    "C:\Users\Admin\Pictures\yF9LasH0TlQy9jPwMQ5ufQPr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Users\Admin\Pictures\yF9LasH0TlQy9jPwMQ5ufQPr.exe
      "C:\Users\Admin\Pictures\yF9LasH0TlQy9jPwMQ5ufQPr.exe"
      4⤵
      Executes dropped EXE
      Checks for VirtualBox DLLs, possible anti-VM trick
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4348
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5840
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4800
- - C:\Users\Admin\Pictures\vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
    "C:\Users\Admin\Pictures\vJJ3jEPCxuhlMXe5Sf7NfOCA.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2720
  - - C:\Users\Admin\Pictures\vJJ3jEPCxuhlMXe5Sf7NfOCA.exe
      "C:\Users\Admin\Pictures\vJJ3jEPCxuhlMXe5Sf7NfOCA.exe"
      4⤵
      Executes dropped EXE
      Checks for VirtualBox DLLs, possible anti-VM trick
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2840
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1592
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1036
- - C:\Users\Admin\Pictures\gMKTuD6m3oGmvt9msdk8SHZT.exe
    "C:\Users\Admin\Pictures\gMKTuD6m3oGmvt9msdk8SHZT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4312
  - - C:\Users\Admin\Pictures\gMKTuD6m3oGmvt9msdk8SHZT.exe
      "C:\Users\Admin\Pictures\gMKTuD6m3oGmvt9msdk8SHZT.exe"
      4⤵
      Executes dropped EXE
      Checks for VirtualBox DLLs, possible anti-VM trick
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3952
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5096

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4380

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\J8wZDTaHQILZd8QBZqhxuSoL.exe

Filesize
4.1MB

MD5
5fe730ab2ac35a2539d3a10fa546e8db

SHA1
b4d5706fed29221a76998a189e60175e28d6e997

SHA256
79b82ab87b8cc6b6ba829a2c3675cc1fef342a6d1c0d06c0afd9942c9726dc1a

SHA512
e7db08dc832ad04728d244c6cffedb5d3c72672f95e54533b72392af67ead0e3bef400e6865f2add226f740751686f2ba07dfa3341694a36c49f235a85a76636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
988e08d818e07d996e7c5ce58b648ac0

SHA1
5718c0f0c0c0a4726cb091eb25965c8a9bea151e

SHA256
a4441909ed8d78eda3afa83723e40cbb79b077de6b65d86f4f6e72fe9d1abbad

SHA512
97197c1927a0ec152dd6b5be2569cdf442d4a4fac7dca09637faf3d5bec1aae59cf02f6d7aca25df5ef66402ed44adf8231d2237175e5895f24c1889912d1c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
584f0ef9283697fdeea3784c5819180d

SHA1
25afc5e9154f3ff8650f3528b50d3a4509ac93c7

SHA256
bcdc4c6f81749d608e8360674afc44e1271e1ea4ac91dbdead10ed0a766883db

SHA512
158862749d35a886e30a291bc03b6f0aa0f14bc30209d3173d256fed4b1b73cf81bab5613f54a20056213e65491a83d3828b84183be75cdb29a2c564dfd5ebfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0e5927f96810bce1188e48420e2d4ca7

SHA1
506309c03d8ea48d02fc7e94de416763910b2d3f

SHA256
5090651bd86f0b16b840580bf252f784037206ced344d1678f2239f714e61cae

SHA512
7fc82b08ee22fb1ed7728d97d9ce818b16c35e34544cb2f2ed403e8774be7f9251088a5a04e786c72b15a48a603ec6a3649fbc08102fcd65f0675ddfcab7f8dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_katnoiso.rsv.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
6606cc9178562daf20b2f00c784fae2c

SHA1
a354d2c3436745de11156c6f9a30e18d9ec0f190

SHA256
7f14b179571b92565dc9955769bb622f3073ad53008e29efb5557b53a71b23dd

SHA512
a04a6053e69730278651a33d1076b9c793b688f4bdbb7b5a938d1be7c979c8e19a46f020722681e99c2c68afd1c87ba51c2704488e20ace4624c232f3c893cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
eceab8555f7b6d38c68349e8e3f37033

SHA1
55f2484038f756d82dbe88aeb87aee153356c23b

SHA256
d3ce7f6cd5c070318cba085dc3396a75aaa70175b81d0054dae56a2e3b8c1481

SHA512
ebcbe1a9a6b69fc1b98fd04fefbc37ac5138022c7c4918802cc9df302d42c02415945dd98148c3b248d80843b5e3e91f5050411e02d0a7a6f4b3101bdc318069

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3do.0.exe

Filesize
223KB

MD5
280229b137b0f36f2b18b9bc7841995d

SHA1
d800c8ecc758ccacfe9a91efd45904efcc17b84a

SHA256
49533fc0ca008e430d35fdabab4b200a70e629e62f5b16f9157b5a82b6494536

SHA512
aeb7566ad83b6b1a01e2d8f6e557a18a75a8bd4229f72cc9e1b1ffe9dd86d14469937eea221e0d436274d4444d4f1732098b98ca3ddc3c7aec65867107fbdec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3do.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\Pictures\3Akm9jHwqPWAdNMfOFGZ18g1.exe

Filesize
4.1MB

MD5
acc96ea4633ab3916b47a71560de1ac4

SHA1
c1fc7d97eea75535e3fc9bdb3c8b3070ac058bcf

SHA256
e7e791761b87d13024503f0b3268130634febc3639b5765541180dbfa5c852ac

SHA512
e26b9afff50e18f6746c6555aed29ead0e1533d4e3fddf8fb0ac7b80abe93cbdb50f3e48964fcaefa3a88f7238390a1f43b031d27cf72fd7fea64d2cdb8bebad

Download Submit
C:\Users\Admin\Pictures\6KaT1Rp2HalmFEU6mGLxFVFw.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\VVaDuqieiq9TWRq0IFjiFFu3.exe

Filesize
364KB

MD5
d916c4ede41cf6b9ca2bdd7bd4f19005

SHA1
31c6d1f4876eec95862786ef6d993347fbfc656c

SHA256
9c4f9d4d6d4d6fbb87de616e5cc4677f2742e4d09d313aae95dc41f1a96c2571

SHA512
ccefa722cbf9b9062eeaf9730a0eba45e23ee3f6a84eba9423eefdfb6c812342d1634d52ea265e8a65592694cf015f1f31e12760ec46bcbe65aa323377cb9e68

Download Submit
C:\Users\Admin\Pictures\bOVotBXlFohNlMzqsG8Eue9y.exe

Filesize
18KB

MD5
949f191270e024e75823b32174f15754

SHA1
e2685aee44aaee2bc87888ee7c86d77bba313eae

SHA256
c3356a89f9d9962232df6a5d6dbfb42a9e2b2578b2a8d89c20b61c4c2e72c71c

SHA512
d3eea70b18938ab93b4d659a0dcb793ab1f440614763b005c9e3f9bf36e4ad49c87cd9d436d2821c34c194a6ec384c57351be4bf9164caaf269046d29c01a55a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
42cb49bc0ba1b76840b1e6e205b44048

SHA1
02e94a589becb44f96d7fea09632a3be2b7821b3

SHA256
afebef3f32bfaec423003905c4b3446d5ff09b64bce0d7ef21722ebc6ec1ed4d

SHA512
266a3c527d9b7210786e9aabffad9be0a206679b7e4aabba1a8be41742e5fd0a7008ca1bbbc9ab77ef45a61a54a8d5b181f9c5bfa14a1a577b1bb54732a4f036

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
2815bdc892fc2b5efcf21061aa846560

SHA1
b3cb666923ac839fa34dbee2f969b59e997760d1

SHA256
6476adb6314970739e27db12f9a78102249dac4b3d5a0b3b883e5babd07e35b2

SHA512
456f1ec3e1b51a1a91de7487afd41dddab3206d0189ae38feee6887f176ae9ad10e99eec4b2ca1135891a9cd5251e7976870acb22cf51e3bcbf5243034c2c7d2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b3d14d207b13d7c1643df458227b41e0

SHA1
671cb07a9a822a0364a4472948ccc66b78fc4d92

SHA256
6aff3a6d4f54e8b6677eb472a08ef939916007f32faddd0871425273d8a9e5be

SHA512
841f947e2ecc5f42a5076c982533137926def6fc0b2897e8e7c8bda8947976b6af10f921ed9701f6886f588f06ae330dce7733fe8b4c5d0018dbb915f5356ee9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
eea4312b48364412b8557e95c458f8c9

SHA1
ebdc362b8b7d68b1c33aa0d5197023dbf2417ebc

SHA256
6260dce108e9a94eec550857aa4100843f33410a8947093fa2e4254430b82be6

SHA512
96ade41eb0017370fac31b6296771777570c3a0532a793aaf71f06b3328456c0809c4bc0de250ac086e528cb2af3105cd0052623c01f9afa4a283f4134bebcaa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f30049d32118e6cc185ab9c2cc324b8a

SHA1
667fa381603f2746494bdfc8e91313043d731137

SHA256
6c1aed39243a6cd73f6c09676c7adf6424426e8c1307b8506991858a8ebdaa52

SHA512
1d973b41a6eeb7fc5b0b53ae95de47f96b5228ae07ba51cd00b0d6dac7f7d3c287c1bd442e104233391e12431d8e2d504051c3945d3eefa1ce7aa94cbae675e8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
a7b13a25971d22dc9b784e19fb6b0e87

SHA1
5fa63676e375ebace469544a51af0f5ee8ac452b

SHA256
46bd1eac7e5f3202e2a2db95af874babcddedbc5f5a9e8baac69d7bfce112cbe

SHA512
34bcd1f4db4f90d3058be13373db0791766c680c695c57b8914962b72703020491a1cedec06ac62a25e85e52e5f617999d387da87c2955b2a73a8eb3f8b08882

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f59e0833d30a769550e2c2fe516f567d

SHA1
7a0262d878f90bd4d4ea434d5548b19c0b15f3ba

SHA256
47ef3a3350731b77ed9b718bdc41329e26a5c30590059d4cf28b7887081fa09c

SHA512
8ac6e5cf5bbe699116bf64080c88b618a00dd879cc8b1e9b48a667a343d4593adbfc93e2beb0a6d0fe59369b32f198695c0f4b439c4c767f1532a713a972c1d3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
18c64cf1e834af85d59e585e83741255

SHA1
83899cd0cef43fac6154d81c031f231a69cd2ae4

SHA256
24e064f31f02385dfcb580cc55b3114c131c7a5a794700fc0baca5c6503001de

SHA512
72c191430ecfb9f6ac019a2c8d11238c7c09842c21aa00493ffe4406da7efae9cc602808b56222cf81008cd00e404c4da9fe4946fe69b9aa96572227b5658073

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
e2a2a0b070264e0a1d3e0d95e08020f6

SHA1
bc56956326b4d16f35aa48f3066b6aea8a86a3b5

SHA256
1e25f2bcb9fa23dea0bae8be9928d3c25fcaf77085bf515cb82ec2f975134d4a

SHA512
39d598d4f89e6c4827d2131a3bd898427c217116461507a0f4b96b3b551ff27c8190707f9a81e039f8d1a7f6cfa5d982357bb36592fd342e0808161bb951c152

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
fa951c895eb9cad81ada16a8ca8c2ba9

SHA1
d998a071ea533b9a8051ebc5d75231e61abcb747

SHA256
3996567c9746577e71bb5f0683961d46c694cb30ec0596db65d096637e22dc03

SHA512
60db90fcd2724324ba377ab15110c539018a94ad650fe611519d4c90ec4c4f0683e3e954104723391e94efec8e4bf6e725b9c0f9965479331250f8bcdce9e624

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
0040f1b8843d60da7311f96f069c6d6e

SHA1
7bf9269b495d3891de14969aade39f69fa95f96e

SHA256
41810e7097ebb382ff03c7772aac29bc1c52a100fdaf41e900fed860f0b9a057

SHA512
de44b11cf851bcc596611a04caf2c7dc258469f8344aafdb7004ae61eecd6847ce68863e62337b1fbfd87b1ba261e178852466c934a689cf805fd5af46759a7c

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/376-2361-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/376-2360-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/1036-3290-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/1036-3291-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/1488-1278-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/1488-1385-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/1488-1367-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/2092-4258-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/2092-4263-0x0000000009310000-0x00000000093B5000-memory.dmp

Filesize
660KB

Download
memory/2092-4257-0x000000006F4B0000-0x000000006F4FB000-memory.dmp

Filesize
300KB

Download
memory/2092-4237-0x0000000008610000-0x000000000865B000-memory.dmp

Filesize
300KB

Download
memory/2104-1459-0x000000006DF10000-0x000000006E260000-memory.dmp

Filesize
3.3MB

Download
memory/2104-1458-0x000000006F390000-0x000000006F3DB000-memory.dmp

Filesize
300KB

Download
memory/2316-4737-0x000000006F4B0000-0x000000006F4FB000-memory.dmp

Filesize
300KB

Download
memory/2320-2690-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/2320-2661-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/2344-330-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/2344-1269-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/2720-378-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/2720-377-0x000000006F3F0000-0x000000006F43B000-memory.dmp

Filesize
300KB

Download
memory/2720-126-0x0000000007810000-0x0000000007832000-memory.dmp

Filesize
136KB

Download
memory/2720-388-0x000000000A8B0000-0x000000000A944000-memory.dmp

Filesize
592KB

Download
memory/2720-127-0x0000000008030000-0x0000000008096000-memory.dmp

Filesize
408KB

Download
memory/2720-128-0x00000000080A0000-0x0000000008106000-memory.dmp

Filesize
408KB

Download
memory/3428-181-0x0000000008A00000-0x0000000008A3C000-memory.dmp

Filesize
240KB

Download
memory/3428-120-0x0000000004F90000-0x0000000004FC6000-memory.dmp

Filesize
216KB

Download
memory/3428-132-0x0000000008590000-0x00000000085DB000-memory.dmp

Filesize
300KB

Download
memory/3428-306-0x00000000095D0000-0x0000000009646000-memory.dmp

Filesize
472KB

Download
memory/3428-355-0x000000006F3F0000-0x000000006F43B000-memory.dmp

Filesize
300KB

Download
memory/3428-360-0x000000000A3C0000-0x000000000A3DE000-memory.dmp

Filesize
120KB

Download
memory/3428-359-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/3428-354-0x000000000A3E0000-0x000000000A413000-memory.dmp

Filesize
204KB

Download
memory/3676-1249-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3676-1267-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3676-329-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3824-1270-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3824-305-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3824-1248-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3852-331-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3852-1268-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/3884-4497-0x000000006F4B0000-0x000000006F4FB000-memory.dmp

Filesize
300KB

Download
memory/3884-4498-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/4156-4981-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4156-4975-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4164-1365-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/4164-4238-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/4164-4962-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/4164-2524-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/4164-1250-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/4280-372-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/4280-129-0x0000000008310000-0x0000000008660000-memory.dmp

Filesize
3.3MB

Download
memory/4280-130-0x0000000008700000-0x000000000871C000-memory.dmp

Filesize
112KB

Download
memory/4280-370-0x000000006F3F0000-0x000000006F43B000-memory.dmp

Filesize
300KB

Download
memory/4280-131-0x0000000008C10000-0x0000000008C5B000-memory.dmp

Filesize
300KB

Download
memory/4312-365-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/4312-1178-0x0000000008960000-0x0000000008968000-memory.dmp

Filesize
32KB

Download
memory/4312-125-0x0000000007920000-0x0000000007F48000-memory.dmp

Filesize
6.2MB

Download
memory/4312-1113-0x0000000008970000-0x000000000898A000-memory.dmp

Filesize
104KB

Download
memory/4312-371-0x000000000A5B0000-0x000000000A655000-memory.dmp

Filesize
660KB

Download
memory/4312-358-0x000000006F3F0000-0x000000006F43B000-memory.dmp

Filesize
300KB

Download
memory/4380-222-0x0000000000400000-0x0000000002597000-memory.dmp

Filesize
33.6MB

Download
memory/4380-387-0x0000000000400000-0x0000000002597000-memory.dmp

Filesize
33.6MB

Download
memory/4392-2357-0x0000000009510000-0x00000000095B5000-memory.dmp

Filesize
660KB

Download
memory/4392-2349-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/4392-2292-0x00000000080D0000-0x000000000811B000-memory.dmp

Filesize
300KB

Download
memory/4392-2350-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/4480-15-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4480-11-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4480-9-0x000002116B4E0000-0x000002116B502000-memory.dmp

Filesize
136KB

Download
memory/4480-76-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4480-25-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4480-14-0x000002116BFD0000-0x000002116C046000-memory.dmp

Filesize
472KB

Download
memory/4760-2267-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4760-0-0x00000263DED60000-0x00000263DED6A000-memory.dmp

Filesize
40KB

Download
memory/4760-1-0x00007FFC5D583000-0x00007FFC5D584000-memory.dmp

Filesize
4KB

Download
memory/4760-1377-0x00007FFC5D583000-0x00007FFC5D584000-memory.dmp

Filesize
4KB

Download
memory/4760-2-0x00000263E0AA0000-0x00000263E0AFE000-memory.dmp

Filesize
376KB

Download
memory/4760-3-0x00007FFC5D580000-0x00007FFC5DF6C000-memory.dmp

Filesize
9.9MB

Download
memory/4800-3525-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/4800-3578-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/5016-4968-0x0000000000BA0000-0x0000000000C4E000-memory.dmp

Filesize
696KB

Download
memory/5096-3995-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/5096-3998-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/5100-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5100-26-0x000000007378E000-0x000000007378F000-memory.dmp

Filesize
4KB

Download
memory/5100-3751-0x000000007378E000-0x000000007378F000-memory.dmp

Filesize
4KB

Download
memory/5168-1688-0x0000020677E10000-0x0000020677E24000-memory.dmp

Filesize
80KB

Download
memory/5168-2277-0x0000020677FC0000-0x0000020677FCA000-memory.dmp

Filesize
40KB

Download
memory/5168-2315-0x000002067DE80000-0x000002067E3A6000-memory.dmp

Filesize
5.1MB

Download
memory/5168-2306-0x000002067D5D0000-0x000002067D608000-memory.dmp

Filesize
224KB

Download
memory/5168-2308-0x000002067D8B0000-0x000002067D8BA000-memory.dmp

Filesize
40KB

Download
memory/5168-1689-0x0000020677F90000-0x0000020677FB4000-memory.dmp

Filesize
144KB

Download
memory/5168-2332-0x000002067D8C0000-0x000002067D8CC000-memory.dmp

Filesize
48KB

Download
memory/5168-1478-0x00000206720E0000-0x0000020675914000-memory.dmp

Filesize
56.2MB

Download
memory/5168-1686-0x0000020677E00000-0x0000020677E10000-memory.dmp

Filesize
64KB

Download
memory/5168-2310-0x000002067D930000-0x000002067D952000-memory.dmp

Filesize
136KB

Download
memory/5168-1685-0x00000206781F0000-0x00000206782FA000-memory.dmp

Filesize
1.0MB

Download
memory/5168-2278-0x0000020678430000-0x00000206784E2000-memory.dmp

Filesize
712KB

Download
memory/5168-2309-0x000002067D8D0000-0x000002067D932000-memory.dmp

Filesize
392KB

Download
memory/5168-2307-0x000002067C780000-0x000002067C788000-memory.dmp

Filesize
32KB

Download
memory/5168-2295-0x000002067C060000-0x000002067C068000-memory.dmp

Filesize
32KB

Download
memory/5168-2290-0x00000206785E0000-0x00000206788E0000-memory.dmp

Filesize
3.0MB

Download
memory/5168-2286-0x0000020677DE0000-0x0000020677DEA000-memory.dmp

Filesize
40KB

Download
memory/5168-2282-0x0000020678560000-0x00000206785B0000-memory.dmp

Filesize
320KB

Download
memory/5168-1687-0x0000020677E20000-0x0000020677E2C000-memory.dmp

Filesize
48KB

Download
memory/5168-2279-0x00000206784E0000-0x000002067850A000-memory.dmp

Filesize
168KB

Download
memory/5168-3468-0x000002067D970000-0x000002067D98E000-memory.dmp

Filesize
120KB

Download
memory/5524-4233-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5524-2521-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5524-3750-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5524-2266-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5524-1376-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5524-4086-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-4085-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-2520-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-2265-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-4194-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-3749-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5532-1375-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5540-2264-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5540-1374-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5540-4012-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5540-3746-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5540-2517-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-2263-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-4087-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-3740-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-4084-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-1368-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5652-2516-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5704-2526-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/5704-2525-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/5848-1364-0x000000006F390000-0x000000006F3DB000-memory.dmp

Filesize
300KB

Download
memory/5848-1289-0x00000000080B0000-0x0000000008400000-memory.dmp

Filesize
3.3MB

Download
memory/5848-1292-0x0000000008880000-0x00000000088CB000-memory.dmp

Filesize
300KB

Download
memory/5848-1366-0x000000006DF10000-0x000000006E260000-memory.dmp

Filesize
3.3MB

Download
memory/5848-1373-0x00000000099F0000-0x0000000009A95000-memory.dmp

Filesize
660KB

Download
memory/5928-1396-0x000000006F390000-0x000000006F3DB000-memory.dmp

Filesize
300KB

Download
memory/5928-1453-0x000000006DF10000-0x000000006E260000-memory.dmp

Filesize
3.3MB

Download
memory/5948-1394-0x000000006F390000-0x000000006F3DB000-memory.dmp

Filesize
300KB

Download
memory/5948-1395-0x000000006DF10000-0x000000006E260000-memory.dmp

Filesize
3.3MB

Download
memory/5972-3298-0x000000006F410000-0x000000006F45B000-memory.dmp

Filesize
300KB

Download
memory/5972-3299-0x000000006EA20000-0x000000006ED70000-memory.dmp

Filesize
3.3MB

Download
memory/6064-4961-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/6064-4973-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/6064-4976-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/6064-4979-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/6064-4505-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/6064-4982-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download