Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/05/2023, 19:36

General

  • Target

    e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260.exe

  • Size

    4.2MB

  • MD5

    f41f9c84ef57697d47c1db9375337170

  • SHA1

    5d8e04d26cfdec4edc3bc1fe0c655df28ec673e5

  • SHA256

    e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260

  • SHA512

    073df3e4389b87805184d9f6f9da10b224ff946f47ce4588cf033455f112f125cf41486b497259fa107f63ae5de2939f5d5a38f2494d4ff8de7352a46e231dba

  • SSDEEP

    98304:7fotdft2Td4gQwaJkDKeyqBAQCzIbjpAhOcr++4XCgx:WdV29Qwq3RQSIbjLhggx

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 15 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260.exe
    "C:\Users\Admin\AppData\Local\Temp\e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3444
    • C:\Users\Admin\AppData\Local\Temp\e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260.exe
      "C:\Users\Admin\AppData\Local\Temp\e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3628
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3476
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3800
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4276
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4316
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3636
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4052
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4608
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4912
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Windows\SysWOW64\sc.exe
              sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Launches sc.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:2112
    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4788

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3rga2cz.31h.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus.tmp

      Filesize

      2.2MB

      MD5

      e343413cf7f26de14a6865bec2c6d5b0

      SHA1

      b811a29993e230d148fe8b88635c5bc43fd1478e

      SHA256

      875cd97fd585ea07f7e86ee63911d3ead31224fd61d6362bbdc6b0d300cdd731

      SHA512

      469f820d9481b694569e1e9e9e72eb77ed69337bf1b63bd1e9da55c310b5475410716e17452b91cb8f3e905dba72bc14e29b4baf3754447c3351108caa8d843c

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

      Filesize

      5.1MB

      MD5

      becbff9b52de9a49af8bea7abf9025b9

      SHA1

      607d1dfb8e866d0e69db8490e93b2f19f75fc6dc

      SHA256

      e3e152b27eb556c95d4a27d09976f00c8fdebadfd9f464e90f0383adb9ccc6d0

      SHA512

      31770b73ab06e66fa840bcc53cc1ce8db22cc79d2de828f2d16c49e4e4ccca2b5b5ed465e8b94ba30ec502a36fec1b5fa5487149a623eb2acb922cee1a29d491

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip

      Filesize

      3.8MB

      MD5

      c72911dec6ae8c4bc62bb2a6a21ba85b

      SHA1

      0ae7077313a53103c2b32100d74aafc04216289d

      SHA256

      7e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f

      SHA512

      99dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip6

      Filesize

      5.6MB

      MD5

      ed2f9b19dd1584d7e26f5ba460ef2fbf

      SHA1

      dcbf1789bf1eeb03276b830cb2ab92bcf779d97f

      SHA256

      f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add

      SHA512

      dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc

      Filesize

      227B

      MD5

      17c2994d6a89cb7d277f1b3f0b49e5ed

      SHA1

      2a72ffc34cb2a7d7d3057f4725f2ac660a809158

      SHA256

      38ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f

      SHA512

      d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      db01a2c1c7e70b2b038edf8ad5ad9826

      SHA1

      540217c647a73bad8d8a79e3a0f3998b5abd199b

      SHA256

      413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

      SHA512

      c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      063c0714a68255f781fadcd2200e689c

      SHA1

      b3a179a93a06991b3f9065b3c421c2c1f60eca9e

      SHA256

      f1ce58afcee06e30ecfbb2cc6c505bd32394dfd062f9f35281c19fac3062cff2

      SHA512

      7cf99c73098574a341736adec4c5492b067844ddc7b813ceb22b53e01e99c3f07af9c21cb045376aeb5a25eedba6d1462256419acbc5f05cce96c0ffab0a4435

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      9d10ea5473d18588827db5606ba90b40

      SHA1

      74a265efe55e83a25b659e44dc66d90200d0f202

      SHA256

      4429be6f1648d5132d0fdf62bc2f13573fc4fcbfbddf5e4529258cd686fa23ee

      SHA512

      0609b87b110942bce3619e7ae443b021cb16e0ffac23c91062a9461225ac4b7727a596aaf3b53c2185171af13c2517f2634ecb288e11fe11dc99b0c3fcdfc101

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      ce6392383f0b5d494a7e47cdffb1d6d9

      SHA1

      abc4d594d3e93a1aff2b9b1de681cf183d2d7e15

      SHA256

      fb8514b0ee59ff90726e9a87946f7158c7457383fef1624dcc15441121873d28

      SHA512

      5f516241ef041c585678178f5c28118d16b224bd35255485861b51214e03f1bfc3f00e8c29193af52b713d5497d5abf6412e99f0584f8e050db33e3385f63e41

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      b1e54b7221aaa4c382d4941bfc2dfe3e

      SHA1

      12c4db6d03329cd1bd94aee8b09530fa719ce21b

      SHA256

      126e974e3c75fada1888758fcf1d08dfa3d5425b6984b78e79047b533a5f690a

      SHA512

      a72b0c39c93d133214180422890c8472046e777361ed109789722f61007f52f80f90fc5ccfc1c6e5299aa27a28b07b508b7587e317139af52e071ecbc1910d62

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      c9f0bb96f720d85ef2ccee5cd3eaee31

      SHA1

      69e1232515f56ffa7a73cdf5f5f8f8863c475435

      SHA256

      fe6ffec7064475418e48ac9648d9c06e2c1ddb28b33d309cc36617ad6517a365

      SHA512

      48eeec1637fc38571393a00d1ec68149a7b369f4cee32640e9257bbe63a91e31a42bd3cd44efc3b79bfa50afc67a809c3a07486f3cd8c064e496c41260a15258

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      f41f9c84ef57697d47c1db9375337170

      SHA1

      5d8e04d26cfdec4edc3bc1fe0c655df28ec673e5

      SHA256

      e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260

      SHA512

      073df3e4389b87805184d9f6f9da10b224ff946f47ce4588cf033455f112f125cf41486b497259fa107f63ae5de2939f5d5a38f2494d4ff8de7352a46e231dba

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      f41f9c84ef57697d47c1db9375337170

      SHA1

      5d8e04d26cfdec4edc3bc1fe0c655df28ec673e5

      SHA256

      e9dd9d2168af907a8b9bbf33e3cdff309ef4aa1a13420cb28744f883f233a260

      SHA512

      073df3e4389b87805184d9f6f9da10b224ff946f47ce4588cf033455f112f125cf41486b497259fa107f63ae5de2939f5d5a38f2494d4ff8de7352a46e231dba

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • \Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • memory/628-666-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/628-1154-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/628-990-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2216-1187-0x0000000009090000-0x0000000009135000-memory.dmp

      Filesize

      660KB

    • memory/2216-1182-0x000000007EAC0000-0x000000007EAD0000-memory.dmp

      Filesize

      64KB

    • memory/2216-1163-0x0000000004730000-0x0000000004740000-memory.dmp

      Filesize

      64KB

    • memory/2216-1162-0x0000000004730000-0x0000000004740000-memory.dmp

      Filesize

      64KB

    • memory/2216-1229-0x0000000004730000-0x0000000004740000-memory.dmp

      Filesize

      64KB

    • memory/2216-1161-0x0000000007D70000-0x0000000007DBB000-memory.dmp

      Filesize

      300KB

    • memory/2216-1159-0x0000000007690000-0x00000000079E0000-memory.dmp

      Filesize

      3.3MB

    • memory/2496-1985-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1893-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1750-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-2008-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1420-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1999-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1972-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1936-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2496-1963-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2572-187-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2572-419-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/2572-122-0x0000000002EB0000-0x000000000379B000-memory.dmp

      Filesize

      8.9MB

    • memory/3444-396-0x0000000009EA0000-0x0000000009EBA000-memory.dmp

      Filesize

      104KB

    • memory/3444-202-0x000000007F580000-0x000000007F590000-memory.dmp

      Filesize

      64KB

    • memory/3444-199-0x000000000A370000-0x000000000A404000-memory.dmp

      Filesize

      592KB

    • memory/3444-198-0x000000000A1C0000-0x000000000A265000-memory.dmp

      Filesize

      660KB

    • memory/3444-193-0x0000000008780000-0x000000000879E000-memory.dmp

      Filesize

      120KB

    • memory/3444-192-0x000000000A180000-0x000000000A1B3000-memory.dmp

      Filesize

      204KB

    • memory/3444-203-0x0000000006E80000-0x0000000006E90000-memory.dmp

      Filesize

      64KB

    • memory/3444-329-0x0000000006E80000-0x0000000006E90000-memory.dmp

      Filesize

      64KB

    • memory/3444-184-0x0000000009320000-0x0000000009396000-memory.dmp

      Filesize

      472KB

    • memory/3444-153-0x0000000009260000-0x000000000929C000-memory.dmp

      Filesize

      240KB

    • memory/3444-134-0x0000000008710000-0x000000000875B000-memory.dmp

      Filesize

      300KB

    • memory/3444-133-0x00000000081F0000-0x000000000820C000-memory.dmp

      Filesize

      112KB

    • memory/3444-132-0x0000000007E20000-0x0000000008170000-memory.dmp

      Filesize

      3.3MB

    • memory/3444-131-0x0000000007DB0000-0x0000000007E16000-memory.dmp

      Filesize

      408KB

    • memory/3444-130-0x0000000007B60000-0x0000000007BC6000-memory.dmp

      Filesize

      408KB

    • memory/3444-331-0x0000000006E80000-0x0000000006E90000-memory.dmp

      Filesize

      64KB

    • memory/3444-129-0x0000000007450000-0x0000000007472000-memory.dmp

      Filesize

      136KB

    • memory/3444-128-0x0000000006E80000-0x0000000006E90000-memory.dmp

      Filesize

      64KB

    • memory/3444-401-0x0000000009E90000-0x0000000009E98000-memory.dmp

      Filesize

      32KB

    • memory/3444-127-0x0000000006E80000-0x0000000006E90000-memory.dmp

      Filesize

      64KB

    • memory/3444-126-0x00000000074C0000-0x0000000007AE8000-memory.dmp

      Filesize

      6.2MB

    • memory/3444-125-0x0000000004D30000-0x0000000004D66000-memory.dmp

      Filesize

      216KB

    • memory/3628-446-0x000000007EA20000-0x000000007EA30000-memory.dmp

      Filesize

      64KB

    • memory/3628-424-0x0000000007820000-0x0000000007B70000-memory.dmp

      Filesize

      3.3MB

    • memory/3628-451-0x00000000091E0000-0x0000000009285000-memory.dmp

      Filesize

      660KB

    • memory/3628-427-0x0000000008070000-0x00000000080BB000-memory.dmp

      Filesize

      300KB

    • memory/3628-426-0x0000000000E00000-0x0000000000E10000-memory.dmp

      Filesize

      64KB

    • memory/3628-425-0x0000000000E00000-0x0000000000E10000-memory.dmp

      Filesize

      64KB

    • memory/3628-520-0x0000000000E00000-0x0000000000E10000-memory.dmp

      Filesize

      64KB

    • memory/3636-1432-0x0000000009100000-0x00000000091A5000-memory.dmp

      Filesize

      660KB

    • memory/3636-1407-0x0000000007F90000-0x0000000007FDB000-memory.dmp

      Filesize

      300KB

    • memory/3636-1405-0x0000000004650000-0x0000000004660000-memory.dmp

      Filesize

      64KB

    • memory/3636-1404-0x0000000004650000-0x0000000004660000-memory.dmp

      Filesize

      64KB

    • memory/3636-1403-0x0000000007640000-0x0000000007990000-memory.dmp

      Filesize

      3.3MB

    • memory/3636-1490-0x0000000004650000-0x0000000004660000-memory.dmp

      Filesize

      64KB

    • memory/3636-1430-0x000000007E3F0000-0x000000007E400000-memory.dmp

      Filesize

      64KB

    • memory/3800-912-0x0000000006730000-0x0000000006740000-memory.dmp

      Filesize

      64KB

    • memory/3800-995-0x0000000006730000-0x0000000006740000-memory.dmp

      Filesize

      64KB

    • memory/3800-993-0x000000007F6E0000-0x000000007F6F0000-memory.dmp

      Filesize

      64KB

    • memory/3800-911-0x0000000006730000-0x0000000006740000-memory.dmp

      Filesize

      64KB

    • memory/4052-1648-0x0000000004B20000-0x0000000004B30000-memory.dmp

      Filesize

      64KB

    • memory/4052-1649-0x0000000004B20000-0x0000000004B30000-memory.dmp

      Filesize

      64KB

    • memory/4052-1673-0x000000007E170000-0x000000007E180000-memory.dmp

      Filesize

      64KB

    • memory/4052-1728-0x0000000004B20000-0x0000000004B30000-memory.dmp

      Filesize

      64KB

    • memory/4788-1958-0x0000000073AD0000-0x0000000073DD1000-memory.dmp

      Filesize

      3.0MB

    • memory/4788-1973-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-1950-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-1951-0x0000000073FF0000-0x00000000740B1000-memory.dmp

      Filesize

      772KB

    • memory/4788-1952-0x0000000073FD0000-0x0000000073FEE000-memory.dmp

      Filesize

      120KB

    • memory/4788-1953-0x0000000073F80000-0x0000000073FCD000-memory.dmp

      Filesize

      308KB

    • memory/4788-1954-0x0000000073EE0000-0x0000000073F80000-memory.dmp

      Filesize

      640KB

    • memory/4788-1956-0x0000000073EB0000-0x0000000073EDA000-memory.dmp

      Filesize

      168KB

    • memory/4788-1957-0x0000000073DE0000-0x0000000073EA2000-memory.dmp

      Filesize

      776KB

    • memory/4788-2009-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-1928-0x0000000073FF0000-0x00000000740B1000-memory.dmp

      Filesize

      772KB

    • memory/4788-1964-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-2000-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-1929-0x0000000073EB0000-0x0000000073EDA000-memory.dmp

      Filesize

      168KB

    • memory/4788-1930-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4788-1991-0x0000000000B00000-0x0000000000F4E000-memory.dmp

      Filesize

      4.3MB

    • memory/4940-671-0x0000000000E40000-0x0000000000E50000-memory.dmp

      Filesize

      64KB

    • memory/4940-695-0x000000007FA60000-0x000000007FA70000-memory.dmp

      Filesize

      64KB

    • memory/4940-697-0x0000000000E40000-0x0000000000E50000-memory.dmp

      Filesize

      64KB

    • memory/4940-672-0x0000000000E40000-0x0000000000E50000-memory.dmp

      Filesize

      64KB