glupteba | 716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d

Analysis

max time kernel
69s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe
Size

2.7MB
MD5

d2f812118c89341715fbff0ba9530396
SHA1

8e9cfa2ebe51e9f71d55b161fb13aae13ee3744f
SHA256

716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d
SHA512

7a1884c5b2130db511f318103ece6ae1499c1e877e4dfc39d6c83b762febea258b5921fa72ae3b413ecfc752b571b2ce33f6fa1f680461d94fc3d2f1988d6c77
SSDEEP

24576:tRoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvQB5VA0UC1dUUKj/LZ8j3gy:boKmo4jC6Tov2RUC1doj/wgy

Score

10^/10

glupteba privateloader dropper evasion execution loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

resource	yara_rule
behavioral1/memory/628-136-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2936-150-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4604-149-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/1804-151-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2936-218-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4604-222-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/1804-223-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2804-258-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4412-259-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2804-345-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4412-347-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2804-387-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4412-390-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/4412-393-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/3532-456-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2912-457-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/3732-528-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/2912-617-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/3532-616-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba
behavioral1/memory/3732-618-0x0000000000400000-0x0000000002959000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	qwlxcrrIfd23swm1wpphs3Uj.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe
1504	powershell.exe
1380	powershell.exe
2924	powershell.exe
4084	powershell.exe
1236	powershell.exe
432	powershell.exe
628	powershell.exe
4632	powershell.exe
2196	powershell.exe
3624	powershell.exe
3796	powershell.exe
2724	powershell.exe
4104	powershell.exe
5044	powershell.exe
4328	powershell.exe
3192	powershell.exe
2780	powershell.exe
3428	powershell.exe
4632	powershell.exe
3064	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1936	netsh.exe
4836	netsh.exe
1368	netsh.exe
212	netsh.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FeGMN43NbxhXOvhbuLqcfs0M.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q6MuscHLZi7f82LKnWz9Z2dA.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\roNypwsAinWhNXY5iHf46twR.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ybVWAKZUDBAPlVgb8sZOHFs.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2KBeim7n9vS6KhCkHCpiPdX.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fcUjvDXRTY2eGnQgEfXVlNMo.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5C6RIO0MXbu5Jp4WSPg5ONYw.bat	regsvcs.exe

Executes dropped EXE 8 IoCs

pid	Process
628	VXHuQ5dR5DiwlckVZTF8yIAp.exe
4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe
2936	ZkoojOdFc5td2MetQvAXFOKF.exe
1804	IwDnT2Dmer47FioLvlMrSHOa.exe
696	tpL7G7cDqk7kVUHqclXvHUUH.exe
1344	qwlxcrrIfd23swm1wpphs3Uj.exe
2804	VXHuQ5dR5DiwlckVZTF8yIAp.exe
4412	SqDNk8kfaJ3UmeKBzB9e2FOP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
11	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
80	api.myip.com
81	api.myip.com
86	ipinfo.io
87	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	qwlxcrrIfd23swm1wpphs3Uj.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	qwlxcrrIfd23swm1wpphs3Uj.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	qwlxcrrIfd23swm1wpphs3Uj.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	qwlxcrrIfd23swm1wpphs3Uj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	696	WerFault.exe	94

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tpL7G7cDqk7kVUHqclXvHUUH.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tpL7G7cDqk7kVUHqclXvHUUH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tpL7G7cDqk7kVUHqclXvHUUH.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
432	powershell.exe
432	powershell.exe
628	VXHuQ5dR5DiwlckVZTF8yIAp.exe
628	VXHuQ5dR5DiwlckVZTF8yIAp.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe
4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	regsvcs.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	628	VXHuQ5dR5DiwlckVZTF8yIAp.exe
Token: SeImpersonatePrivilege	628	VXHuQ5dR5DiwlckVZTF8yIAp.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe
Token: SeImpersonatePrivilege	4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2160	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4232 wrote to memory of 2160	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4232 wrote to memory of 2160	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4232 wrote to memory of 2160	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	86
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4232 wrote to memory of 4008	4232	716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe	88
PID 4008 wrote to memory of 628	4008	regsvcs.exe	90
PID 4008 wrote to memory of 628	4008	regsvcs.exe	90
PID 4008 wrote to memory of 628	4008	regsvcs.exe	90
PID 4008 wrote to memory of 4604	4008	regsvcs.exe	91
PID 4008 wrote to memory of 4604	4008	regsvcs.exe	91
PID 4008 wrote to memory of 4604	4008	regsvcs.exe	91
PID 4008 wrote to memory of 2936	4008	regsvcs.exe	92
PID 4008 wrote to memory of 2936	4008	regsvcs.exe	92
PID 4008 wrote to memory of 2936	4008	regsvcs.exe	92
PID 4008 wrote to memory of 1804	4008	regsvcs.exe	93
PID 4008 wrote to memory of 1804	4008	regsvcs.exe	93
PID 4008 wrote to memory of 1804	4008	regsvcs.exe	93
PID 4008 wrote to memory of 696	4008	regsvcs.exe	94
PID 4008 wrote to memory of 696	4008	regsvcs.exe	94
PID 4008 wrote to memory of 696	4008	regsvcs.exe	94
PID 628 wrote to memory of 432	628	VXHuQ5dR5DiwlckVZTF8yIAp.exe	106
PID 628 wrote to memory of 432	628	VXHuQ5dR5DiwlckVZTF8yIAp.exe	106
PID 628 wrote to memory of 432	628	VXHuQ5dR5DiwlckVZTF8yIAp.exe	106
PID 4008 wrote to memory of 1344	4008	regsvcs.exe	108
PID 4008 wrote to memory of 1344	4008	regsvcs.exe	108
PID 4604 wrote to memory of 5044	4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe	111
PID 4604 wrote to memory of 5044	4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe	111
PID 4604 wrote to memory of 5044	4604	SqDNk8kfaJ3UmeKBzB9e2FOP.exe	111
PID 2936 wrote to memory of 1504	2936	ZkoojOdFc5td2MetQvAXFOKF.exe	118
PID 2936 wrote to memory of 1504	2936	ZkoojOdFc5td2MetQvAXFOKF.exe	118
PID 2936 wrote to memory of 1504	2936	ZkoojOdFc5td2MetQvAXFOKF.exe	118
PID 1804 wrote to memory of 4328	1804	IwDnT2Dmer47FioLvlMrSHOa.exe	121
PID 1804 wrote to memory of 4328	1804	IwDnT2Dmer47FioLvlMrSHOa.exe	121
PID 1804 wrote to memory of 4328	1804	IwDnT2Dmer47FioLvlMrSHOa.exe	121

C:\Users\Admin\AppData\Local\Temp\716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe
"C:\Users\Admin\AppData\Local\Temp\716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Users\Admin\Pictures\VXHuQ5dR5DiwlckVZTF8yIAp.exe
    "C:\Users\Admin\Pictures\VXHuQ5dR5DiwlckVZTF8yIAp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Users\Admin\Pictures\VXHuQ5dR5DiwlckVZTF8yIAp.exe
      "C:\Users\Admin\Pictures\VXHuQ5dR5DiwlckVZTF8yIAp.exe"
      4⤵
      Executes dropped EXE
      PID:2804
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4996
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1936
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:628
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:3732
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3624
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:456
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:736
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3428
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4104
- - C:\Users\Admin\Pictures\SqDNk8kfaJ3UmeKBzB9e2FOP.exe
    "C:\Users\Admin\Pictures\SqDNk8kfaJ3UmeKBzB9e2FOP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Users\Admin\Pictures\SqDNk8kfaJ3UmeKBzB9e2FOP.exe
      "C:\Users\Admin\Pictures\SqDNk8kfaJ3UmeKBzB9e2FOP.exe"
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1620
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4084
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1236
- - C:\Users\Admin\Pictures\ZkoojOdFc5td2MetQvAXFOKF.exe
    "C:\Users\Admin\Pictures\ZkoojOdFc5td2MetQvAXFOKF.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1504
  - - C:\Users\Admin\Pictures\ZkoojOdFc5td2MetQvAXFOKF.exe
      "C:\Users\Admin\Pictures\ZkoojOdFc5td2MetQvAXFOKF.exe"
      4⤵
      PID:3532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3228
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1368
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3192
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2196
- - C:\Users\Admin\Pictures\IwDnT2Dmer47FioLvlMrSHOa.exe
    "C:\Users\Admin\Pictures\IwDnT2Dmer47FioLvlMrSHOa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4328
  - - C:\Users\Admin\Pictures\IwDnT2Dmer47FioLvlMrSHOa.exe
      "C:\Users\Admin\Pictures\IwDnT2Dmer47FioLvlMrSHOa.exe"
      4⤵
      PID:2912
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4392
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2724
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2780
- - C:\Users\Admin\Pictures\tpL7G7cDqk7kVUHqclXvHUUH.exe
    "C:\Users\Admin\Pictures\tpL7G7cDqk7kVUHqclXvHUUH.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 352
      4⤵
      Program crash
      PID:4592
- - C:\Users\Admin\Pictures\qwlxcrrIfd23swm1wpphs3Uj.exe
    "C:\Users\Admin\Pictures\qwlxcrrIfd23swm1wpphs3Uj.exe"
    3⤵
    - Modifies firewall policy service
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1344
- - C:\Users\Admin\Pictures\tCL0Yi0ghgFNhaaMt1HXgzHF.exe
    "C:\Users\Admin\Pictures\tCL0Yi0ghgFNhaaMt1HXgzHF.exe"
    3⤵
    PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\u3j0.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3j0.0.exe"
      4⤵
      PID:3116
- - C:\Users\Admin\Pictures\dOLNPI48WQJUiQYTU5ePHJoE.exe
    "C:\Users\Admin\Pictures\dOLNPI48WQJUiQYTU5ePHJoE.exe"
    3⤵
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\7zS5EEF.tmp\Install.exe
      .\Install.exe /tEdidDDf "385118" /S
      4⤵
      PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:4440
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:4920
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:3148
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:3500
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4932
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:4972
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:5056
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:2320
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:4424
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3064
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:3652
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4632
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 696 -ip 696
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a6ea7bfcd3aac150c0caef765cb52281

SHA1
037dc22c46a0eb0b9ad4c74088129e387cffe96b

SHA256
f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

SHA512
c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
c3f7fb2df0febe1358fcfb8f205f20c6

SHA1
453e2cbbfb6ec5834091a000535f60c59b3b8547

SHA256
68212aeb05bd2eb8837bfa8d8891dd95b85cb7d3dcdcefc85256496c69d86265

SHA512
0ac571fc62f45ea843eb5cd9841cf292554b7df5a5e807e7ea4e0cc806718c83d6500fdfc64af0faf11bf7260efd18997f8e08881743fa5782c47413f34b047d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
aea133901f43ce4f03e77abcc5906345

SHA1
9cb047f38e20dd8dbc21c89a07f80e85a8c5f5ee

SHA256
5249bb40852d559720b43ab2420209530c03d1d1088cd6e70d50673c8472c474

SHA512
29a0e99bd79aa42ddbc8803a474c2d32eea7fa049df7af13496b6093b844a87a87460727bc81cc4c336fe609e4bd9180c1bc18588a29f285eba1b22874ec8867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
f798385fae377d4c0156900a73e77729

SHA1
938aa14d95176aad7d5223ef89d752c2fce8e0be

SHA256
6992639cd74518c25adc03e6113a309adf8d24d5ca23a328f8731533d3e7a1b6

SHA512
8661912f4a45172af72a0cd4076cd2f8e54300bc015e166633cd354a611eac9420859ac6807d9b4d9c5cc6c3871231ec0eede527c3ba09c829ac47865c992e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5EEF.tmp\Install.exe

Filesize
6.4MB

MD5
220a02a940078153b4063f42f206087b

SHA1
02fc647d857573a253a1ab796d162244eb179315

SHA256
7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

SHA512
42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgzth3u3.bxj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3j0.0.exe

Filesize
231KB

MD5
eabfdaca74d258561209e731259bf818

SHA1
5bf324d6792cef6cb1663c88002480029aa8c1a8

SHA256
8122ab1285665bacd89fa9865281315c62b94eb10910927283424ff283f5fb1b

SHA512
42277497bb262f951f066b1e069c57173832b5cc7697111c80b1a5f95f769fed4a3cc6ff4d96d8ad78f60690fec2a1a7497d8f0b24a6971fd70a67ac63f32ef3

Download Submit
C:\Users\Admin\Pictures\VXHuQ5dR5DiwlckVZTF8yIAp.exe

Filesize
4.1MB

MD5
81973860f6243f10498dcae7cbce588d

SHA1
1aef2304fc626b033912e0b3f3bd9e82128de110

SHA256
db54e1ea122f80356ecc745695afb947589efa854e962780359ca58fa5f04eb5

SHA512
b2a0714f5b9bc5fb5cc03f26e526b64cc592ad89312ba753180ce2afa375e3305f021af27b40afc0ef13d405c2b9364cdfc574efa186b1b512cfe0a42edab281

Download Submit
C:\Users\Admin\Pictures\ZFL5UgqfbG0wHNmjV8eaAHvx.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\ZkoojOdFc5td2MetQvAXFOKF.exe

Filesize
4.1MB

MD5
aa21cc00b06fa9cf4f2f2986a2ce7730

SHA1
b7c47a82c88295631ac59e69561b2032d3bdf561

SHA256
4b75302f0298a6fcd0beb9f1798a64be19221c238bb18c274f1454548165a76b

SHA512
01ffed899607f8813cf27d988cd59071e4c7e995b666c5a9fce000640103af5efb3ca8281c16074aafc148ea686e8c6c0acd6aae82ae6fce2ad076b2b83db345

Download Submit
C:\Users\Admin\Pictures\dOLNPI48WQJUiQYTU5ePHJoE.exe

Filesize
6.2MB

MD5
5cc472dcd66120aed74de36341bfd75a

SHA1
1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

SHA256
958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

SHA512
b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

Download Submit
C:\Users\Admin\Pictures\qwlxcrrIfd23swm1wpphs3Uj.exe

Filesize
1.4MB

MD5
411602e57a0df5f835f74066f38bc84c

SHA1
7207ef4fbc5ae0145c3dbcd10d8cdb1b22287c30

SHA256
2f1e42016a3f2cfa0817f49ebd0e765c07d87b4692a14df7c8b38232422060ff

SHA512
87bd2b7770462a17368ab3a3278c3f3ef6bf873e6b2c83179025ad348730f14ced5461ab0a6ebf81236ec83c2c1eef0faf73479a6d40ad9ed198e9c3011eaa7d

Download Submit
C:\Users\Admin\Pictures\tCL0Yi0ghgFNhaaMt1HXgzHF.exe

Filesize
372KB

MD5
d0408852e9e32afcbd649688e7468b6b

SHA1
83a10133dc3a52c50dcc9d6143a5fa1abdb47076

SHA256
57d32a6ee7ded04e612eb459fdd91b232009f253a86038ab2798f66b760daef6

SHA512
663c6f97808da4b47a642b0043a1df11465cc11f193def532ef69368cf39baf7db0038a49bb67a512cfbbd98490af4dd9bc586d033fc67470af1b8afa235e6fd

Download Submit
C:\Users\Admin\Pictures\tpL7G7cDqk7kVUHqclXvHUUH.exe

Filesize
231KB

MD5
405dd6e9634a6adb16f3cdb649d67d2c

SHA1
426d37976e43aaa653671eb596ceab300c930b55

SHA256
10e744b0e7b3e177e009fad374f8a9a407c542dcc9fb3b4b332e2ea18c57e86f

SHA512
4ca4faf5a7e83b24140fffae421a7b4ed286cedcd9407b153b5f31d6f5f2bd31911597f6567ae8388fe2fcc137fbc95397d5401f5477b1044e3b51e3207138df

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e0ad4b90532c994efabfcf3da0b2ca6d

SHA1
0a5442c9fe76baccea1c9bee30d28029338799bd

SHA256
8c9c234c2f4e774b3a8c7944d8a720b43fd1cfbd972146063a3c8f6bfab5b888

SHA512
896bdc86fac34edd7ed9ec342279364ce0818a470c85fc114156744999399d3ee6b08030eab51c2ef497532c58c795fa913c9bc84283b9ad39bda82f48d7cceb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4cb9bd310bfbee2b881333f75eb3ccbd

SHA1
beb5ccf44e1d140de71b8fe3938920babbf7db0e

SHA256
4d11a0b6afb06b6ea311ffb0e17d363095232f4ca3b7a938789ffca7b67e44c6

SHA512
54fa7364f7afef66a5c453177372a40dcd9345ade1a53bbe7492d783378a770e0eadd7e57a1bb91827ebbed3d4c1ba934c7b6bfee49bb9044d79ee572cbc72ab

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
323c413765ed5c9c05721c5c85c78996

SHA1
c59babe04a8fbeab5834d681cd49a12cbc5823f7

SHA256
7c822cf1f754a3a300bcfd5cc3b89e4b2e165a52c4e0783b96674c9d166dc846

SHA512
4a7c41c390ad8f54870ba9021b6b2b1585c7d013937b53fcdb7029e384a4083946930db0a71ab1f88e03044ff56d16774524024f2710cfea978a203c1ad64c38

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
6788afb62e3c40476a3fd79cbdb95679

SHA1
0c5225412281948f2ce2ec561db37a3e8efe264d

SHA256
73ca3d2f535f6a86fb5c0aafa45cb60d0c9dd0a58b0a7e3e07ca8a0a01a667e9

SHA512
84feeba5202a6bd3794f1622657dea219e05dfc2bdc423f20f09c0899a15a21821fdccf479d54005fac307d3847d1710d4929a7ae9fb47756be2882344e2e7da

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
28c7aa4756b947efb1f4e8d3766aa05a

SHA1
cc9bc29799733f96125391aa72c4652bf676316f

SHA256
ca4ce2d75dd5b871e398c62737b6534335fe4c9a3f2ea3641459cc72147dc6ff

SHA512
34cecdee1664aecd691a6e54a587a30fde06850d7e21eb968405d80516b69b2c7c89953016a53539aa4d4083b2d1e858352f7684978e53de24018f05a3ff0779

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4e8819b6eb88929e52fc618d19bf38c0

SHA1
2c891cb0f1b5249b898680cc04c335542e63f928

SHA256
08b03d543916e115181b06209292e2f6e2e4af18a9f8526e7426585856121407

SHA512
724ef7b6b341a6d361404abf1c8dd76407ab1ddcf22fdd6ec5d9088a119bb04d1b55a3d68dddd241463d6a47a669c834fdeac5cd4f9f314c0c6a633ff9d6680e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
99419023b65c679df8e3005e88a5313f

SHA1
e200944ee57cb5d42ca90c6ddb1795d282b1c0b7

SHA256
32bc704833e5ce932623eff699ed027680ff49609f1bb81d4a5c38302d6582bc

SHA512
5fefd89db73d37d02dd15bb822ce39c7a5ef1fd36449a74f1ce49f7330c019332a850cf86e2b7b02f502a0edd8b929db27f800e8d1691c09b5d7b2b4528e773b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b61007e46e7974d1f01f5fa137da4583

SHA1
693168219b690e570a697323a7288a92499bd358

SHA256
b06ccb0442c6ef2fbc4cfb962e49cf7335190dd58dff78b8c3b24c0d664d63c4

SHA512
14272558b85f05385c4a0433cf4d66945d78b5e1318adb76483e2e3fdfb1289015775e73a19cfe9bfba31fb58edcb5d672f3957f32ddd4696d6ba4dbdd96316c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
a71c9e34be90b62555f6f4c7390ced41

SHA1
a9d833c913aa93827c5215b92d10906f6c40f3d0

SHA256
9ddd6a8d214a8b9e5ef23e044f19246ca3ca358160a7d9981381a9bd5d2bf6bc

SHA512
6663ed43ea0159526be179f5327bb08540a7d1de212981cfbe6f365d5de91634dedb6513b9ae56764fc908891898f094eca7ead8a92c42214586ffdcbfc30c8a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
9eda64152d067ebeb648f286450ffd6c

SHA1
9294a201688e6c58e0953e0de93230baf54a72ec

SHA256
b64885d896eaae99943106522a6b434b6a84faed2e80de2c19c043fae2a1be08

SHA512
0c5ee819cb511c83c33d232aeeee0de883e114650b5e11a2b0dff5ee619562eba1dcf1204cd86ae1e39395981288d00b13aa30671f876109312a58fbcd00b355

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/432-76-0x0000000004C20000-0x0000000004C86000-memory.dmp

Filesize
408KB

Download
memory/432-92-0x0000000007570000-0x0000000007BEA000-memory.dmp

Filesize
6.5MB

Download
memory/432-73-0x0000000002580000-0x00000000025B6000-memory.dmp

Filesize
216KB

Download
memory/432-115-0x0000000007220000-0x000000000722A000-memory.dmp

Filesize
40KB

Download
memory/432-114-0x0000000007130000-0x00000000071D3000-memory.dmp

Filesize
652KB

Download
memory/432-127-0x00000000072E0000-0x0000000007376000-memory.dmp

Filesize
600KB

Download
memory/432-128-0x0000000007240000-0x0000000007251000-memory.dmp

Filesize
68KB

Download
memory/432-129-0x0000000007280000-0x000000000728E000-memory.dmp

Filesize
56KB

Download
memory/432-130-0x0000000007290000-0x00000000072A4000-memory.dmp

Filesize
80KB

Download
memory/432-131-0x0000000007380000-0x000000000739A000-memory.dmp

Filesize
104KB

Download
memory/432-132-0x00000000072C0000-0x00000000072C8000-memory.dmp

Filesize
32KB

Download
memory/432-97-0x00000000070D0000-0x0000000007102000-memory.dmp

Filesize
200KB

Download
memory/432-74-0x0000000004D20000-0x0000000005348000-memory.dmp

Filesize
6.2MB

Download
memory/432-98-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Filesize
304KB

Download
memory/432-99-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/432-110-0x0000000007110000-0x000000000712E000-memory.dmp

Filesize
120KB

Download
memory/432-93-0x0000000006F10000-0x0000000006F2A000-memory.dmp

Filesize
104KB

Download
memory/432-91-0x0000000006E70000-0x0000000006EE6000-memory.dmp

Filesize
472KB

Download
memory/432-90-0x0000000006CE0000-0x0000000006D24000-memory.dmp

Filesize
272KB

Download
memory/432-75-0x0000000004B80000-0x0000000004BA2000-memory.dmp

Filesize
136KB

Download
memory/432-77-0x0000000005350000-0x00000000053B6000-memory.dmp

Filesize
408KB

Download
memory/432-87-0x0000000005500000-0x0000000005854000-memory.dmp

Filesize
3.3MB

Download
memory/432-88-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Filesize
120KB

Download
memory/432-89-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download
memory/628-360-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/628-361-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/628-136-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/696-164-0x0000000000400000-0x0000000002576000-memory.dmp

Filesize
33.5MB

Download
memory/1236-372-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/1236-371-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/1344-190-0x0000000140000000-0x00000001403BD000-memory.dmp

Filesize
3.7MB

Download
memory/1344-119-0x0000000140000000-0x00000001403BD000-memory.dmp

Filesize
3.7MB

Download
memory/1380-272-0x00000000070A0000-0x0000000007143000-memory.dmp

Filesize
652KB

Download
memory/1380-285-0x0000000007410000-0x0000000007424000-memory.dmp

Filesize
80KB

Download
memory/1380-273-0x00000000073C0000-0x00000000073D1000-memory.dmp

Filesize
68KB

Download
memory/1380-262-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/1380-261-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/1504-191-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/1504-203-0x00000000075E0000-0x00000000075F1000-memory.dmp

Filesize
68KB

Download
memory/1504-192-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/1504-202-0x00000000074A0000-0x0000000007543000-memory.dmp

Filesize
652KB

Download
memory/1504-205-0x0000000005CC0000-0x0000000005CD4000-memory.dmp

Filesize
80KB

Download
memory/1804-223-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/1804-151-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2196-493-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/2196-494-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/2624-619-0x0000000000A30000-0x000000000109E000-memory.dmp

Filesize
6.4MB

Download
memory/2624-647-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/2724-515-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/2724-514-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/2724-541-0x0000000005D50000-0x0000000005D64000-memory.dmp

Filesize
80KB

Download
memory/2724-529-0x0000000007950000-0x0000000007961000-memory.dmp

Filesize
68KB

Download
memory/2780-590-0x0000000005930000-0x0000000005944000-memory.dmp

Filesize
80KB

Download
memory/2780-564-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/2780-559-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/2804-345-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2804-258-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2804-387-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2912-457-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2912-617-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2924-274-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/2924-275-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/2936-150-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/2936-218-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/3192-471-0x0000000006360000-0x0000000006371000-memory.dmp

Filesize
68KB

Download
memory/3192-460-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/3192-459-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/3428-591-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/3428-589-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/3532-616-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/3532-456-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/3624-531-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/3624-530-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/3656-442-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/3656-458-0x0000000005C90000-0x0000000005CA4000-memory.dmp

Filesize
80KB

Download
memory/3656-443-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/3732-618-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/3732-528-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/3796-313-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/3796-312-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/4008-3-0x000000007515E000-0x000000007515F000-memory.dmp

Filesize
4KB

Download
memory/4008-72-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/4008-71-0x000000007515E000-0x000000007515F000-memory.dmp

Filesize
4KB

Download
memory/4008-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4008-4-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/4084-324-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/4084-323-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/4104-637-0x000000006FEE0000-0x0000000070234000-memory.dmp

Filesize
3.3MB

Download
memory/4104-652-0x00000000063F0000-0x0000000006404000-memory.dmp

Filesize
80KB

Download
memory/4104-651-0x00000000063B0000-0x00000000063C1000-memory.dmp

Filesize
68KB

Download
memory/4104-636-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/4104-634-0x0000000006040000-0x0000000006394000-memory.dmp

Filesize
3.3MB

Download
memory/4232-2-0x00007FF6F33F0000-0x00007FF6F3739000-memory.dmp

Filesize
3.3MB

Download
memory/4232-0-0x00007FF6F33F0000-0x00007FF6F3739000-memory.dmp

Filesize
3.3MB

Download
memory/4328-206-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/4328-204-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/4412-259-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4412-347-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4412-390-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4412-393-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4572-527-0x0000000000400000-0x0000000002599000-memory.dmp

Filesize
33.6MB

Download
memory/4604-222-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4604-149-0x0000000000400000-0x0000000002959000-memory.dmp

Filesize
37.3MB

Download
memory/4632-409-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/4632-421-0x0000000005F50000-0x0000000005F64000-memory.dmp

Filesize
80KB

Download
memory/4632-420-0x0000000007700000-0x0000000007711000-memory.dmp

Filesize
68KB

Download
memory/4632-419-0x00000000073B0000-0x0000000007453000-memory.dmp

Filesize
652KB

Download
memory/4632-408-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/5044-152-0x00000000703B0000-0x00000000703FC000-memory.dmp

Filesize
304KB

Download
memory/5044-148-0x00000000061E0000-0x000000000622C000-memory.dmp

Filesize
304KB

Download
memory/5044-153-0x0000000070030000-0x0000000070384000-memory.dmp

Filesize
3.3MB

Download
memory/5044-167-0x0000000005AC0000-0x0000000005AD4000-memory.dmp

Filesize
80KB

Download
memory/5044-163-0x0000000007280000-0x0000000007323000-memory.dmp

Filesize
652KB

Download
memory/5044-165-0x0000000005A80000-0x0000000005A91000-memory.dmp

Filesize
68KB

Download