Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/05/2023, 12:30

General

  • Target

    fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9.exe

  • Size

    4.2MB

  • MD5

    68a793f4e34f8dc0a0cad7560abb1278

  • SHA1

    62e146b705993027ed64bede647e3236b16f5ecc

  • SHA256

    fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9

  • SHA512

    8b45c3f91935e7e0c9a70ed6cec2ee1aa148b02fb70c97ac96a0d18571230f6f4c433601d5bee2b17169aac2b0ec984b8685ea4e56522f3235b1588cc88164e6

  • SSDEEP

    98304:xrUGdppI8t3V6iRl8sEREZKpg91CQ+AdZtms:KEfrt3Pl87EcpE1rdZtt

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 13 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9.exe
    "C:\Users\Admin\AppData\Local\Temp\fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9.exe
      "C:\Users\Admin\AppData\Local\Temp\fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5088
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3872
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4840
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1556
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:5044
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1580
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5068
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:752
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4616
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2436
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5004
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4620
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4632
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4224
            • C:\Windows\SysWOW64\sc.exe
              sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Launches sc.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:2196
          • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            4⤵
            • Executes dropped EXE
            PID:5020
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:3516
    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4280

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2bpcq4d.myf.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus.tmp

      Filesize

      2.3MB

      MD5

      5875de0876749dc5b173793224f173a7

      SHA1

      f60823a3f70aadcf4059e4a7b7e6dd38559586ee

      SHA256

      d2fd479cea41e5f0c718d76d264a393d410751169dc87e8553135bfc0a57632a

      SHA512

      ea52295ccf0ec32f62133714ea1e7156951d0e9b3bd1484806fbbb60a381cd29060f49ff063266cb5162522a7c20d1303aab648e9c749fe534360f9b0c3f48f2

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

      Filesize

      6.0MB

      MD5

      ebe90a1bdeabe6aa379bc5b003397848

      SHA1

      bf0c72c50de38e1919b4ba3550efc0d01be27b8d

      SHA256

      e44043cad2b85c59dff792701397f76bcb15b70479eb1a8805e6aa7f3aba968b

      SHA512

      b4c3c156103ddff25b8150983522289da9393fe5c4a0407e60ea589b3b6a9af93205619ea17336d970153d36bb2798796a087e2f556cff156931a04513d95ba2

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip

      Filesize

      3.8MB

      MD5

      c72911dec6ae8c4bc62bb2a6a21ba85b

      SHA1

      0ae7077313a53103c2b32100d74aafc04216289d

      SHA256

      7e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f

      SHA512

      99dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip6

      Filesize

      5.6MB

      MD5

      ed2f9b19dd1584d7e26f5ba460ef2fbf

      SHA1

      dcbf1789bf1eeb03276b830cb2ab92bcf779d97f

      SHA256

      f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add

      SHA512

      dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc

      Filesize

      227B

      MD5

      17c2994d6a89cb7d277f1b3f0b49e5ed

      SHA1

      2a72ffc34cb2a7d7d3057f4725f2ac660a809158

      SHA256

      38ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f

      SHA512

      d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      db01a2c1c7e70b2b038edf8ad5ad9826

      SHA1

      540217c647a73bad8d8a79e3a0f3998b5abd199b

      SHA256

      413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

      SHA512

      c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      a7ab56f2c2996ac63f25bf438329df74

      SHA1

      a656ba68bb67ee1eb4cad635028334adf92b5d34

      SHA256

      7420e30b456ebe0dfce603e52a39cdbc9dcc33d559844f1009e2e23d48c3c7a2

      SHA512

      4df1e92de366e721d127f4c14040d8e5e89b1d7ee35866c1cf5d844b4d37a8534c52249300fc3253db133ebb10a081854af5bdc8ecd2f360703c3aa982bea9b0

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      7c0d94f32caabf918a7125f2515fe266

      SHA1

      892bd34e4c3eb21631d86aa3ce690e75289a1831

      SHA256

      bb48183767295b21605209995f469551f3bb0c1f731a790c8857c9779774f422

      SHA512

      3947d2290ca397b58d3bbeffb1c3761f3605f6609ed59468fe8ec9e74798d926a333392491bee558e6781b0bd796f0133b052a52ca65e6b9c6dc1b8d05c29196

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      21bddb529f29edc7bd603bd7b633e5b1

      SHA1

      28d23e927f65a1634a3ab179ee74bd57bedc7767

      SHA256

      ed436fe0770b7e476e56dca56419670cebb1911241e0d6a5f3bde1ace4f4283d

      SHA512

      045b18ba7e57ddd2517056f4e3361794380c2bcebfdf09d41bec5f3b11fe7f17559fbdd57e7a37a8f6587e529eb16d23ab2124b3f1ff2b1936c66ec50fa6c0e3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      faea2f1bb61110b13595ce9477b9f7f1

      SHA1

      8283378458e0b4b15bcbb7580852d825cdaeaaa1

      SHA256

      e79ccb8a62abf9c78b3937212a6876845562ac11bbbed96ea51839a4bb2045c9

      SHA512

      ab928b0ccf77658d5f57481b3158132ef1d5a8ba5ba891a075424795b744bbca4b0d9f4ab5f4e42555f3b49bb39edd7dd706b521a5131a25f7d339745f2f10b1

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      6c19c28b5253c9bc7df7b6532f566af3

      SHA1

      3f97581d874ac2ea83c1ac8970e39dbdeb42c694

      SHA256

      3774cbaec84ed2e8edc14752c8063c2e0caf8a0f40f42c5eb1c0756342ba1d7a

      SHA512

      790c2f94c1d9dea894704f53b2435b23b6943697b540920b046ad9876eae58d6bef62c73bc85bd18c5644c567be58083290d252fc27b833b2811d4fa86c1a8bb

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      68a793f4e34f8dc0a0cad7560abb1278

      SHA1

      62e146b705993027ed64bede647e3236b16f5ecc

      SHA256

      fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9

      SHA512

      8b45c3f91935e7e0c9a70ed6cec2ee1aa148b02fb70c97ac96a0d18571230f6f4c433601d5bee2b17169aac2b0ec984b8685ea4e56522f3235b1588cc88164e6

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      68a793f4e34f8dc0a0cad7560abb1278

      SHA1

      62e146b705993027ed64bede647e3236b16f5ecc

      SHA256

      fe8715d97df7f71400521234d3ccde6d199c2fedae0b0e5fd9e49d9b535590d9

      SHA512

      8b45c3f91935e7e0c9a70ed6cec2ee1aa148b02fb70c97ac96a0d18571230f6f4c433601d5bee2b17169aac2b0ec984b8685ea4e56522f3235b1588cc88164e6

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • memory/752-1651-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/752-1652-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/752-1673-0x000000007F520000-0x000000007F530000-memory.dmp

      Filesize

      64KB

    • memory/752-1744-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/1100-666-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1100-1154-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1100-981-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1556-1254-0x000000007EF60000-0x000000007EF70000-memory.dmp

      Filesize

      64KB

    • memory/1556-1186-0x0000000009C40000-0x0000000009CE5000-memory.dmp

      Filesize

      660KB

    • memory/1556-1164-0x0000000005240000-0x0000000005250000-memory.dmp

      Filesize

      64KB

    • memory/1556-1162-0x00000000089E0000-0x0000000008A2B000-memory.dmp

      Filesize

      300KB

    • memory/1556-1159-0x0000000005240000-0x0000000005250000-memory.dmp

      Filesize

      64KB

    • memory/1556-1160-0x0000000008260000-0x00000000085B0000-memory.dmp

      Filesize

      3.3MB

    • memory/1556-1255-0x0000000005240000-0x0000000005250000-memory.dmp

      Filesize

      64KB

    • memory/1648-1892-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1648-1422-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1648-2002-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1648-1943-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1648-1975-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1648-1985-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1952-270-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1952-420-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1952-126-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1952-122-0x0000000002F40000-0x000000000382B000-memory.dmp

      Filesize

      8.9MB

    • memory/2904-272-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/2904-128-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/2904-125-0x0000000004C30000-0x0000000004C66000-memory.dmp

      Filesize

      216KB

    • memory/2904-127-0x0000000007550000-0x0000000007B78000-memory.dmp

      Filesize

      6.2MB

    • memory/2904-129-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/2904-130-0x00000000073E0000-0x0000000007402000-memory.dmp

      Filesize

      136KB

    • memory/2904-131-0x0000000007BF0000-0x0000000007C56000-memory.dmp

      Filesize

      408KB

    • memory/2904-132-0x0000000007480000-0x00000000074E6000-memory.dmp

      Filesize

      408KB

    • memory/2904-133-0x0000000007DC0000-0x0000000008110000-memory.dmp

      Filesize

      3.3MB

    • memory/2904-134-0x0000000008170000-0x000000000818C000-memory.dmp

      Filesize

      112KB

    • memory/2904-402-0x000000000A110000-0x000000000A118000-memory.dmp

      Filesize

      32KB

    • memory/2904-135-0x00000000084C0000-0x000000000850B000-memory.dmp

      Filesize

      300KB

    • memory/2904-397-0x000000000A210000-0x000000000A22A000-memory.dmp

      Filesize

      104KB

    • memory/2904-154-0x0000000008570000-0x00000000085AC000-memory.dmp

      Filesize

      240KB

    • memory/2904-185-0x0000000009370000-0x00000000093E6000-memory.dmp

      Filesize

      472KB

    • memory/2904-192-0x000000007F7F0000-0x000000007F800000-memory.dmp

      Filesize

      64KB

    • memory/2904-271-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/2904-193-0x000000000A120000-0x000000000A153000-memory.dmp

      Filesize

      204KB

    • memory/2904-194-0x000000000A0E0000-0x000000000A0FE000-memory.dmp

      Filesize

      120KB

    • memory/2904-199-0x000000000A160000-0x000000000A205000-memory.dmp

      Filesize

      660KB

    • memory/2904-200-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/2904-201-0x000000000A340000-0x000000000A3D4000-memory.dmp

      Filesize

      592KB

    • memory/3516-1966-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3516-1936-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3516-2001-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4016-932-0x000000007EA30000-0x000000007EA40000-memory.dmp

      Filesize

      64KB

    • memory/4016-912-0x0000000007070000-0x0000000007080000-memory.dmp

      Filesize

      64KB

    • memory/4016-914-0x0000000007070000-0x0000000007080000-memory.dmp

      Filesize

      64KB

    • memory/4016-984-0x0000000007070000-0x0000000007080000-memory.dmp

      Filesize

      64KB

    • memory/4280-1974-0x0000000072EA0000-0x0000000072EED000-memory.dmp

      Filesize

      308KB

    • memory/4280-2017-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-1973-0x0000000072EF0000-0x00000000731F1000-memory.dmp

      Filesize

      3.0MB

    • memory/4280-1992-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-1935-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-1972-0x0000000073200000-0x00000000732C1000-memory.dmp

      Filesize

      772KB

    • memory/4280-1934-0x0000000073440000-0x000000007346A000-memory.dmp

      Filesize

      168KB

    • memory/4280-1933-0x0000000073200000-0x00000000732C1000-memory.dmp

      Filesize

      772KB

    • memory/4280-1971-0x00000000732D0000-0x0000000073370000-memory.dmp

      Filesize

      640KB

    • memory/4280-1970-0x0000000073370000-0x0000000073432000-memory.dmp

      Filesize

      776KB

    • memory/4280-2025-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-1969-0x0000000073440000-0x000000007346A000-memory.dmp

      Filesize

      168KB

    • memory/4280-1968-0x0000000073470000-0x000000007348E000-memory.dmp

      Filesize

      120KB

    • memory/4280-1967-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-2009-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4280-1977-0x0000000000C40000-0x000000000108E000-memory.dmp

      Filesize

      4.3MB

    • memory/4840-695-0x000000007ED00000-0x000000007ED10000-memory.dmp

      Filesize

      64KB

    • memory/4840-764-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/4840-673-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/4840-674-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/5004-1937-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/5004-1897-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/5020-2008-0x0000000000400000-0x0000000000C25000-memory.dmp

      Filesize

      8.1MB

    • memory/5020-2000-0x0000000000400000-0x0000000000C25000-memory.dmp

      Filesize

      8.1MB

    • memory/5068-1431-0x00000000096A0000-0x0000000009745000-memory.dmp

      Filesize

      660KB

    • memory/5068-1435-0x0000000007090000-0x00000000070A0000-memory.dmp

      Filesize

      64KB

    • memory/5068-1434-0x000000007EE80000-0x000000007EE90000-memory.dmp

      Filesize

      64KB

    • memory/5068-1405-0x0000000007090000-0x00000000070A0000-memory.dmp

      Filesize

      64KB

    • memory/5068-1406-0x0000000008630000-0x000000000867B000-memory.dmp

      Filesize

      300KB

    • memory/5068-1407-0x0000000007090000-0x00000000070A0000-memory.dmp

      Filesize

      64KB

    • memory/5068-1403-0x0000000007D00000-0x0000000008050000-memory.dmp

      Filesize

      3.3MB

    • memory/5088-520-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

      Filesize

      64KB

    • memory/5088-451-0x0000000009A20000-0x0000000009AC5000-memory.dmp

      Filesize

      660KB

    • memory/5088-446-0x000000007ED40000-0x000000007ED50000-memory.dmp

      Filesize

      64KB

    • memory/5088-427-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

      Filesize

      64KB

    • memory/5088-426-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

      Filesize

      64KB

    • memory/5088-425-0x00000000089C0000-0x0000000008A0B000-memory.dmp

      Filesize

      300KB

    • memory/5088-424-0x0000000007F70000-0x00000000082C0000-memory.dmp

      Filesize

      3.3MB