snakekeylogger | 017e5b7d68e109d875d58186b54eb613a3ceef3d54052b19fa4b9adcfea19cff

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
Size

1.1MB
MD5

fddd99d918c32a807cd1761c519b086b
SHA1

8cf7e4c454f20d2ab851bb6e18a4250b7af4157c
SHA256

5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920
SHA512

5243ba74b6919a3d96dffda1a598c47a3ce80426136abe769fa19bf9a138de64a7db87efb2a5cfe6c7bb1e5bdc8655169defe54ee79d3d7ebe16817807ebb06a
SSDEEP

24576:ZlmXjCShkN8Hy//wZhBcV7ilbN1/39e48e:ZlmXjCJN8SXwVL1/9e48e

Score

10^/10

snakekeylogger collection credential_access discovery keylogger persistence stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
zulpine.shop
Port:
587
Username:
[email protected]
Password:
dkA6kDAnLHNg
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4212-1097-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1492 created 3476	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	56

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
27	4744	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bosotkm = "C:\\Users\\Admin\\AppData\\Roaming\\bosotkm.exe"	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	checkip.dyndns.org

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 868 set thread context of 4016	868	powershell.exe	111
PID 4892 set thread context of 3996	4892	powershell.exe	119
PID 3036 set thread context of 4784	3036	powershell.exe	133
PID 4944 set thread context of 1748	4944	powershell.exe	149

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	MSBuild.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	MSBuild.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	MSBuild.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3188	4016	WerFault.exe	111
968	3996	WerFault.exe	119
2412	4784	WerFault.exe	133
2476	1748	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{547D3F0B-65C7-11EF-8D5B-EEE1DD5A0987} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4492	POWERPNT.EXE
3504	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
4212	InstallUtil.exe
4212	InstallUtil.exe
868	powershell.exe
868	powershell.exe
608	powershell.exe
608	powershell.exe
608	powershell.exe
868	powershell.exe
868	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
3036	powershell.exe
3036	powershell.exe
3036	powershell.exe
3036	powershell.exe
4944	powershell.exe
4944	powershell.exe
1148	powershell.exe
1148	powershell.exe
1148	powershell.exe
4944	powershell.exe
4944	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
Token: SeDebugPrivilege	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
Token: SeDebugPrivilege	4212	InstallUtil.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3824	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4492	POWERPNT.EXE
4492	POWERPNT.EXE
4492	POWERPNT.EXE
4492	POWERPNT.EXE
3504	POWERPNT.EXE
3504	POWERPNT.EXE
3504	POWERPNT.EXE
3504	POWERPNT.EXE
3824	iexplore.exe
3824	iexplore.exe
3560	IEXPLORE.EXE
3560	IEXPLORE.EXE
3560	IEXPLORE.EXE
3560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4744	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	94
PID 1492 wrote to memory of 4744	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	94
PID 1492 wrote to memory of 4744	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	94
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 1492 wrote to memory of 4212	1492	5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe	95
PID 4472 wrote to memory of 868	4472	WScript.exe	100
PID 4472 wrote to memory of 868	4472	WScript.exe	100
PID 4472 wrote to memory of 608	4472	WScript.exe	109
PID 4472 wrote to memory of 608	4472	WScript.exe	109
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 4016	868	powershell.exe	111
PID 868 wrote to memory of 3780	868	powershell.exe	112
PID 868 wrote to memory of 3780	868	powershell.exe	112
PID 608 wrote to memory of 544	608	powershell.exe	113
PID 608 wrote to memory of 544	608	powershell.exe	113
PID 4472 wrote to memory of 4892	4472	WScript.exe	117
PID 4472 wrote to memory of 4892	4472	WScript.exe	117
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3996	4892	powershell.exe	119
PID 4892 wrote to memory of 3536	4892	powershell.exe	120
PID 4892 wrote to memory of 3536	4892	powershell.exe	120
PID 4472 wrote to memory of 3036	4472	WScript.exe	131
PID 4472 wrote to memory of 3036	4472	WScript.exe	131
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 4784	3036	powershell.exe	133
PID 3036 wrote to memory of 3300	3036	powershell.exe	134
PID 3036 wrote to memory of 3300	3036	powershell.exe	134
PID 4472 wrote to memory of 4944	4472	WScript.exe	137
PID 4472 wrote to memory of 4944	4472	WScript.exe	137
PID 5084 wrote to memory of 3824	5084	MSOXMLED.EXE	141
PID 5084 wrote to memory of 3824	5084	MSOXMLED.EXE	141
PID 3824 wrote to memory of 3560	3824	iexplore.exe	143
PID 3824 wrote to memory of 3560	3824	iexplore.exe	143
PID 3824 wrote to memory of 3560	3824	iexplore.exe	143
PID 4472 wrote to memory of 1148	4472	WScript.exe	147
PID 4472 wrote to memory of 1148	4472	WScript.exe	147
PID 4944 wrote to memory of 1748	4944	powershell.exe	149
PID 4944 wrote to memory of 1748	4944	powershell.exe	149
PID 4944 wrote to memory of 1748	4944	powershell.exe	149
PID 4944 wrote to memory of 1748	4944	powershell.exe	149

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe
  "C:\Users\Admin\AppData\Local\Temp\5cd8e28712872382cacac0d338a4d041e291b89d41a4daf69eabefe7ec46f920.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msb.vbe"
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:4744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4212
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\StartExpand.potm"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4492
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\StartExpand.potm"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3504
- C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
  "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\StepInitialize.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\StepInitialize.xml
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3824 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3560

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\fNUATsLGslepRpn.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1008
      4⤵
      Program crash
      PID:3188
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "868" "2732" "2628" "2736" "0" "0" "2740" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3780
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "608" "2696" "2624" "2700" "0" "0" "2704" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:544
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1008
      4⤵
      Program crash
      PID:968
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4892" "2720" "2664" "2724" "0" "0" "2728" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1008
      4⤵
      Program crash
      PID:2412
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3036" "2796" "2732" "2800" "0" "0" "2804" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 1008
      4⤵
      Program crash
      PID:2476
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4944" "2748" "2684" "2752" "0" "0" "2756" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3948
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1148" "2680" "2608" "2684" "0" "0" "2688" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3996 -ip 3996
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4784 -ip 4784
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1748 -ip 1748
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7C1.tmp.xml

Filesize
4KB

MD5
5ca2164087309c2a67fe266f6bd18cae

SHA1
63be94d18a065d10ab713aedcc554dfd752bfcf6

SHA256
fce217d60d5ed907d4ef65b678de0d0e820f72755b301ff808006cf3d81dfa9f

SHA512
9b3d544b090851b07d9b6852dea60f3119d61ecafe07d6af0df479c03f030aa3f739402ff4ef4182b8c04204347cb3b9b3427217c88ac3b2ae24c588358f1b2b

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7C1.tmp.xml

Filesize
4KB

MD5
05098b32e998386055e50987b83d2c72

SHA1
58b621a9561ff8c60e7c4a6121215a49f236618b

SHA256
8d2437c8ec2578b9d9ba3a3a735d02f87c4d204aa4a066447889960b7070514d

SHA512
8708e3276505c8a8cb41b8cf0535a76c5a8dd4d9a2ad1bfdc33e024131c6b652c0040928b301204e77af505764f9390b3e3a5b05a447229d6edf63742289212a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
9461a7cfb20ff5381df28f51b80c5ef1

SHA1
c86c53fca1dcbe307dafbefbb366abf52c9f5eca

SHA256
d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028

SHA512
da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B27F3C-59D1-45FB-B11D-CAD996175D27

Filesize
170KB

MD5
a81f236dfe18eafc59fbba3c259542fc

SHA1
910a1603f756a11c184336042d28fe448b5b4c62

SHA256
e772c0f40a347da20d10025567085a8ff54ab1152fca72f1b911d1a142b8c4dc

SHA512
fdda863734003ca21086a64be14e25462087d2536f654ee2b0d86d9824a6d360dddfb860a708d19a433548e9c5473fe18a7404524a9c7943f1b85348a2d435e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml

Filesize
371KB

MD5
b74eb161d37d710b9b22271584485c1a

SHA1
1d88603f131117064de0400089891100ed121fc3

SHA256
e6e361b0652debef9850931222360c37526a2c0db7dee06e9a16c92875c0d433

SHA512
7db4e9e491ba6136947581c6aa66b5d7297520b0e11f4874e0d44dea034ce16e2ea3234bf593167acea944e8ea03cfd03a37a84838e11b9232944447dcd41849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db

Filesize
24KB

MD5
a6064fc9ce640751e063d9af443990da

SHA1
367a3a7d57bfb3e9a6ec356dfc411a5f14dfde2a

SHA256
5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c

SHA512
0e42dd8e341e2334eda1e19e1a344475ed3a0539a21c70ba2247f480c706ab8e2ff6dbeb790614cbde9fb547699b24e69c85c54e99ed77a08fe7e1d1b4b488d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
1ec1eb0fe33bae2803b388568bc1645a

SHA1
be1a4b120b9b19033cec8b12ced428482a890c6b

SHA256
01c64c76314fe29bae2e2391eb5f217877e3a68dc09390f5377b890a37ec19da

SHA512
0ef8dd60cbb65c8c6d2dafefdf91985215b630c1ab136ea187f53bfc15b420cf6d9b78743c63489f3ecfa6589d013a5854e7b994ed7d0bdac42ba764ee43b1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Filesize
4KB

MD5
2798c8198c01775832d932468ba47a89

SHA1
b16bfe2029465ace5e4312a000efa28d6d650f95

SHA256
1d68273e3b991a33ed5d96a59dd137fdfb5da721c986a7c495d7eb99c623bd91

SHA512
c9c943c00855d4572e8f553d1ab1cfb8785e22043e88f50adeb0936bfa232280d0102003ca0904daa74d9f90e07ea013405ebd75a6da71001699dd0f90489521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
3110de631dcbc3710c394aac9776ba2a

SHA1
7d09467a127d6933c43a7cfc778160b1dd88d985

SHA256
35e045a583fc13acb9fa9246330f5c690b61b6d65010a84aca53729f422ad1e7

SHA512
0f603ef42f85091acc734c0cfcc9849a16dbeae6c28a4948506c793044f048bc6bd1048ba256f28bdb8f748e6ff504c792b38d398fa2869c7894f1a448cfc8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
ec098800578ad51fe036b7f2a15e5797

SHA1
cfa3eb17574acb6d1507dcb63f55538a4802e9b5

SHA256
d0f23828e3fd9ee821a6041dca5344a7507a5ec3b003638c64c09f62daedeeee

SHA512
16ff682d54ed437614677cb985636ff861476ef3e86d9a3b1c78f16805e371b4928fd015d7194298ecb3b1589dc92fe919d6c298d06a157a102d72e366ba7852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
d21f4191e6b96e4822db1fdc64f53ad9

SHA1
a70371f55b3c58da791423ea4483cf0272887fee

SHA256
9564e9673d29595bdb8b2ac58814f31c64cb5eb7c05612573223ede0eb784ca8

SHA512
9b89f59a4f6c0e9844e0c4653b591f3ac3a001a326eb149d91055b88e7f8649b8faa85cecd2ffe9c9cbc359d19b81f7e63215c58da10b0e0cfc7642db9527695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
31a7e29bb88256162df82f122cb8fb2c

SHA1
995abdf981290c120e85dab7f23e13e31062cd92

SHA256
50a0fb4a4913a8e3916cb8da16a399b7aecae390c64ac25abc56f3337bbd4c61

SHA512
f444faa91f0269eadd09727c0376e80fdb7aba57454a383f9493cfeaa457979c640dc8d41b22708521475983df52711142335392f31e91f67a33938bea9e67bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1mcoqedn.pyp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msb.vbe

Filesize
13KB

MD5
49b536466d2d4c84bbc92f01d2ea766f

SHA1
ab15ac73d984aee741f2ed5e169c734fd3adb673

SHA256
2c7bed584f136b6fac5820fd762d377a550d7e31eb35b66cf61818ecaf177e23

SHA512
b4f2585cfacd11c948772dc4bc34a5cba3d8113761852c88e2ba23ef4ab1ef50da28c155de711264d735d895dfb321017cce22fd89f39d3089a3d60df9a2eccc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Filesize
252B

MD5
d0edd5550211f3a8ed5054d1a2076b83

SHA1
9883ad3482636713c9a85328f4b559f7dc97abc5

SHA256
1d2f3d87c8fb6c26513a14bf87e967d3234a48c62e71289a9bb9aa8b43ff40ea

SHA512
8ae07ca8b4bcb269582e8504c5947bce4987eb9f9561ee2e9fb4de9046528f6f8381c995059cc10c260272addebd048ca51f3ea2615ffe9cb85baa4e2335730f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Filesize
504B

MD5
dd185f00ba9131efb8020140120fac53

SHA1
f1d3b58538266f770d4d1dcf52a5d081b9663662

SHA256
ad93e25cb0d519e4115db07c063cb20250e6dbb3e9aff4db3706abbc485d2bbc

SHA512
100fbdab7480bab01de0587cc9a33ef8719ae99ccfad01244f8ff1e48bb74fbd3630bc46b6ed17109c7e4b6dc7fedd87b4a13ac70f5610d11e35d8f634f86b34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Filesize
756B

MD5
e60ae9e029d1d65fd5d8cc150e47c2e9

SHA1
50a69ae75103a375d4f6be83a67884a9758a81e7

SHA256
f53938a192e5ed8144dbbe8f05e3bb8e61e2d59ec7e190ad1e3dcd5ddbb4ea02

SHA512
50eae5ecfdba3f9c269a550d79ac477080872061f4b0b0f616f38e1998b8d91915aa55f5ce11ae80c7e0c2bb45d4d8753caced1dda54377e9b21dc7567f4ceb4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
a9ec37ce3f18bdd3c39aea675c027b59

SHA1
1e6c0fbe5217cbb54bd84665f42f73435ce9417a

SHA256
8e607d2aaee7defdc41d8f065f5a848cfdcff7f69f623ea4358211a013ae0146

SHA512
983195211bcdac8634000528e4d18b30221693ea23e5027b531c99b0a7386eb3a5d1cf0e10189f184fa94bb335c0502f359ed755cac459ad9960871707f63faf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
df5028dcb4777321a52fd4f5095af5f2

SHA1
1ee5f9a358bfe9b89c660d671d35aec4edeb3aa4

SHA256
5e2c3c9f418157abbe72f4652f77e3a82dbab25faa2964d32c7a8ffdc0ae7f0d

SHA512
84ca9d9388283e02ef4d8eefee363b60c726060e6d63aeb0e2ab19da97f5e195a8a05df8a95fb26b8ae85f04ee7625f77437e8b5278245fb7eac248edee89c40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b4d05714f1e8f71506d5cecb228fd43b

SHA1
5088cf8321c7d624ea0654ad1a53c04a78e32d63

SHA256
0ce5cf8c1f069ac6d6966737f4018480abde99b4f49b0ecc2a31a4a8719ec57f

SHA512
0f7751cf56f471c91973602a51ce7388cc29275a53aceb8a25060bd32f932cb4a50cc3c29d6f69af5bed72916e19c67f286452bc91451ab906465441a091c621

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
00bab3ed47ce5e9af74828bfa13aa130

SHA1
9fd761172e480a45540022562c414f39a104fd17

SHA256
cfec9b1efed45cea77f78e42d17e46702abbdd9524fd49531586dff3a3ac6dcb

SHA512
5f7fc7ce1a2e70843ba9462b113f711ed351fc38ff6bbc36acdc0e32936edfd531b2d26786a91520f92d535fc3bb8ff5bf256bd6bf9cd9166195451266474381

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
71fbc0ae7a50dac900b61e1ae38b5ec2

SHA1
09b04cc2ea9423b5c3d14a926c98aacdb6179387

SHA256
baea0f2fbbb50d521831aee46af55fba46629bc19a9b0d8050dcdc077c9a0dc1

SHA512
07089f6688f62965cd1c27cbd4a0b8db777a7384750a4c6f983de394355fd19194beabdfcabcf775db7678c27cd8620b900a0d5fb289a3ebd0c75023d5d550c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
18bbae472a0ee7006860667e841ed7c6

SHA1
12456ef10954b5edcc49301060bb896f5eecbb50

SHA256
1728a5e50b2117e775699266e9707122dd206579fb6948c485bfd0d678d8116c

SHA512
4832967b3de7fc6a2701fa1c450367759d6d0b76d68da609684e8531b4d6622482b2cad33bdf99d0f817e160718553e0d937b7f66d71848f5dd55bbd21f9061c

Download Submit
C:\Users\Admin\AppData\Roaming\fNUATsLGslepRpn.vbs

Filesize
2KB

MD5
5f8c9eaa961fd5ceabeb785d2427cc0c

SHA1
d44cb5b6d0715d2d1027a345ac30010c69a9ccd7

SHA256
e205aa6b623c2a0ccfa28517c29e665b2e3b75cc7b2c22db2b6f61dd00893f87

SHA512
50435e2b26a49d4f6071783e78602e48dfd1ae8dd85e7abdfd93acfa4402f400ae9d4e6509ff24d1ef2b96b13c415787ec2be4d10bb5428424f41a2e06b912e8

Download Submit
memory/868-1120-0x000001DF31380000-0x000001DF313F6000-memory.dmp

Filesize
472KB

Download
memory/868-1119-0x000001DF312B0000-0x000001DF312F4000-memory.dmp

Filesize
272KB

Download
memory/868-1169-0x000001DF31290000-0x000001DF31298000-memory.dmp

Filesize
32KB

Download
memory/868-1109-0x000001DF17EF0000-0x000001DF17F12000-memory.dmp

Filesize
136KB

Download
memory/868-1170-0x000001DF312A0000-0x000001DF312AA000-memory.dmp

Filesize
40KB

Download
memory/1492-28-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-18-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-42-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-32-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-6-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-1077-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-1079-0x0000000005B60000-0x0000000005BC2000-memory.dmp

Filesize
392KB

Download
memory/1492-1078-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-1080-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Filesize
304KB

Download
memory/1492-1084-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-1085-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-1086-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-1087-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/1492-1091-0x0000000006F10000-0x00000000074B4000-memory.dmp

Filesize
5.6MB

Download
memory/1492-10-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-1092-0x0000000005D80000-0x0000000005DD4000-memory.dmp

Filesize
336KB

Download
memory/1492-1-0x0000000000F60000-0x0000000001074000-memory.dmp

Filesize
1.1MB

Download
memory/1492-1095-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1492-2-0x0000000005A30000-0x0000000005B18000-memory.dmp

Filesize
928KB

Download
memory/1492-3-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-4-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-46-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-66-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-64-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-62-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-60-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-12-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-14-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-17-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-8-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-20-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-22-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-24-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-26-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/1492-30-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-58-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-34-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-36-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-38-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-40-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-44-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-48-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-50-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-52-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-54-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/1492-56-0x0000000005A30000-0x0000000005B12000-memory.dmp

Filesize
904KB

Download
memory/4016-1172-0x0000000001100000-0x0000000001118000-memory.dmp

Filesize
96KB

Download
memory/4212-1105-0x0000000006180000-0x000000000618A000-memory.dmp

Filesize
40KB

Download
memory/4212-1104-0x00000000061C0000-0x0000000006252000-memory.dmp

Filesize
584KB

Download
memory/4212-1103-0x00000000062F0000-0x00000000064B2000-memory.dmp

Filesize
1.8MB

Download
memory/4212-1102-0x00000000060D0000-0x0000000006120000-memory.dmp

Filesize
320KB

Download
memory/4212-1101-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/4212-1099-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/4212-1098-0x0000000004E50000-0x0000000004EEC000-memory.dmp

Filesize
624KB

Download
memory/4212-1097-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4212-1096-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download