glupteba | 1f4918f590e74fb1b84700ef8962fad2e98dcafa7f490103821013b119b85868

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09057099.exe
Size

4.2MB
MD5

9132a875875f7e0f37afe0376c0a276d
SHA1

43dc298e643fda93d98835e4a2f8a0b7b9828c1b
SHA256

1f4918f590e74fb1b84700ef8962fad2e98dcafa7f490103821013b119b85868
SHA512

e6050ef994f1df011f1fba481d525a264f9eb06f55166bddf2d07c1758869dd937e1428e79f34342dd27c85662f72732efcd5e9598fcb4b470fdf290fbba1d70
SSDEEP

98304:iwPHzJGsSBKd2SXXNMk8lMY/ndSjzYudYViNA+e4n:i+TDj6tfAjsuTVee

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2300-134-0x0000000005130000-0x0000000005A1B000-memory.dmp	family_glupteba
behavioral2/memory/2300-152-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/2300-177-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/3608-183-0x0000000005170000-0x0000000005A5B000-memory.dmp	family_glupteba
behavioral2/memory/2300-208-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/3608-222-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/3608-265-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/3608-271-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-312-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-353-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-361-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-413-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-449-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-460-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-471-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba
behavioral2/memory/4548-485-0x0000000000400000-0x00000000030D0000-memory.dmp	family_glupteba

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4584 netsh.exe
Executes dropped EXE 5 IoCs

Processes:

csrss.exeinjector.exewindefender.exetor.exewindefender.exe

pid process

4548 csrss.exe
2156 injector.exe
1880 windefender.exe
4764 tor.exe
2816 windefender.exe
Loads dropped DLL 9 IoCs

Processes:

tor.exe

pid process

4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe
4764 tor.exe

pid	process
4584	netsh.exe

pid	process
4548	csrss.exe
2156	injector.exe
1880	windefender.exe
4764	tor.exe
2816	windefender.exe

pid	process
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe
4764	tor.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
behavioral2/memory/1880-403-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Windows\windefender.exe	upx
behavioral2/memory/1880-411-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2816-470-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2816-484-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

09057099.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	09057099.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

09057099.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 09057099.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	09057099.exe

Drops file in Windows directory 4 IoCs

Processes:

09057099.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	09057099.exe
File created	C:\Windows\rss\csrss.exe	09057099.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

4628 sc.exe
4556 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4780 3608 WerFault.exe 09057099.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1328 schtasks.exe
1612 schtasks.exe

pid	process
4628	sc.exe
4556	sc.exe

pid	pid_target	process	target process
4780	3608	WerFault.exe	09057099.exe

pid	process
1328	schtasks.exe
1612	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewindefender.exe09057099.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	09057099.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	09057099.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	09057099.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe09057099.exepowershell.exe09057099.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4760	powershell.exe
4760	powershell.exe
2300	09057099.exe
2300	09057099.exe
2032	powershell.exe
2032	powershell.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
3608	09057099.exe
4388	powershell.exe
4388	powershell.exe
4872	powershell.exe
4872	powershell.exe
3228	powershell.exe
3228	powershell.exe
3952	powershell.exe
3952	powershell.exe
3880	powershell.exe
3880	powershell.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
4548	csrss.exe
4548	csrss.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
4548	csrss.exe
4548	csrss.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
4548	csrss.exe
4548	csrss.exe
2156	injector.exe
2156	injector.exe
4548	csrss.exe
4548	csrss.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe
2156	injector.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

powershell.exe09057099.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exesc.exe

description	pid	process
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	2300	09057099.exe
Token: SeImpersonatePrivilege	2300	09057099.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeSystemEnvironmentPrivilege	4548	csrss.exe
Token: SeSecurityPrivilege	4628	sc.exe
Token: SeSecurityPrivilege	4628	sc.exe
Token: SeSecurityPrivilege	4556	sc.exe
Token: SeSecurityPrivilege	4556	sc.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

09057099.exe09057099.execmd.execsrss.exewindefender.execmd.execmd.exe

description	pid	process	target process
PID 2300 wrote to memory of 4760	2300	09057099.exe	powershell.exe
PID 2300 wrote to memory of 4760	2300	09057099.exe	powershell.exe
PID 2300 wrote to memory of 4760	2300	09057099.exe	powershell.exe
PID 3608 wrote to memory of 2032	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 2032	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 2032	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 2556	3608	09057099.exe	cmd.exe
PID 3608 wrote to memory of 2556	3608	09057099.exe	cmd.exe
PID 2556 wrote to memory of 4584	2556	cmd.exe	netsh.exe
PID 2556 wrote to memory of 4584	2556	cmd.exe	netsh.exe
PID 3608 wrote to memory of 4388	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4388	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4388	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4872	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4872	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4872	3608	09057099.exe	powershell.exe
PID 3608 wrote to memory of 4548	3608	09057099.exe	csrss.exe
PID 3608 wrote to memory of 4548	3608	09057099.exe	csrss.exe
PID 3608 wrote to memory of 4548	3608	09057099.exe	csrss.exe
PID 4548 wrote to memory of 3228	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3228	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3228	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3952	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3952	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3952	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3880	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3880	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 3880	4548	csrss.exe	powershell.exe
PID 4548 wrote to memory of 2156	4548	csrss.exe	injector.exe
PID 4548 wrote to memory of 2156	4548	csrss.exe	injector.exe
PID 1880 wrote to memory of 3712	1880	windefender.exe	cmd.exe
PID 1880 wrote to memory of 3712	1880	windefender.exe	cmd.exe
PID 1880 wrote to memory of 3712	1880	windefender.exe	cmd.exe
PID 4548 wrote to memory of 4216	4548	csrss.exe	cmd.exe
PID 4548 wrote to memory of 4216	4548	csrss.exe	cmd.exe
PID 4548 wrote to memory of 4216	4548	csrss.exe	cmd.exe
PID 3712 wrote to memory of 4628	3712	cmd.exe	sc.exe
PID 3712 wrote to memory of 4628	3712	cmd.exe	sc.exe
PID 3712 wrote to memory of 4628	3712	cmd.exe	sc.exe
PID 4216 wrote to memory of 4556	4216	cmd.exe	sc.exe
PID 4216 wrote to memory of 4556	4216	cmd.exe	sc.exe
PID 4216 wrote to memory of 4556	4216	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\09057099.exe
"C:\Users\Admin\AppData\Local\Temp\09057099.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\09057099.exe
  "C:\Users\Admin\AppData\Local\Temp\09057099.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4584
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3228
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3952
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2156
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1612
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3712
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 840
    3⤵
    - Program crash
    PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3608 -ip 3608
1⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4764

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujog1avo.es0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus.tmp

Filesize
2.3MB

MD5
bfb8482236d6bb6f978b8d5957055e11

SHA1
372784b0d81089b20059f9f2b1b474bb9b98c9fe

SHA256
e5cb3e52a7d00d430e1c5d867c7e21bd1201858d790b28c0719d5c87a07c1e60

SHA512
ed041c06463eb05dae5093a899f478d42e009b4a60fd47547163b2241b4bd65dabb6220c223104953cc787cf4ec04de10b997bc699c76272e5ad43c3aef92dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

Filesize
5.7MB

MD5
072bc9e440c74469da89bdef6a605680

SHA1
3808afd940414dbf124c2406ad6d30482496d68c

SHA256
92da73348dd124751c0bbbec6bfff2e7a7180a181eab78db7cc7a351ff21d8d8

SHA512
b6a8a7139e7f5353f27146ac63a7e93ca6f7a84c6118a15bbfa6d1073241abb089b01f16d13942ea0cf73a2d6f7d09458380830e110daa04dbefe6cd5aee25d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip

Filesize
3.8MB

MD5
c72911dec6ae8c4bc62bb2a6a21ba85b

SHA1
0ae7077313a53103c2b32100d74aafc04216289d

SHA256
7e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f

SHA512
99dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip6

Filesize
5.6MB

MD5
ed2f9b19dd1584d7e26f5ba460ef2fbf

SHA1
dcbf1789bf1eeb03276b830cb2ab92bcf779d97f

SHA256
f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add

SHA512
dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

Filesize
876KB

MD5
736443b08b5a52b6958f001e8200be71

SHA1
e56ddc8476aef0d3482c99c5bfaf0f57458b2576

SHA256
da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

SHA512
9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

Filesize
876KB

MD5
736443b08b5a52b6958f001e8200be71

SHA1
e56ddc8476aef0d3482c99c5bfaf0f57458b2576

SHA256
da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

SHA512
9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

Filesize
668KB

MD5
36e1c3814bde3418ba3d38517954cb7c

SHA1
495e1ba5b0b442e70124d33daa6fea4e3e5931b0

SHA256
b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

SHA512
df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

Filesize
668KB

MD5
36e1c3814bde3418ba3d38517954cb7c

SHA1
495e1ba5b0b442e70124d33daa6fea4e3e5931b0

SHA256
b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

SHA512
df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

Filesize
938KB

MD5
d92e59b71bf8a0d827597ed95b2eca42

SHA1
cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

SHA256
b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

SHA512
be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

Filesize
938KB

MD5
d92e59b71bf8a0d827597ed95b2eca42

SHA1
cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

SHA256
b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

SHA512
be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

Filesize
95KB

MD5
7cdbaca31739500aefc06dd85a8558ff

SHA1
adc36ec6a3cdc7e57a1b706c820e382627f6cb90

SHA256
0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

SHA512
6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

Filesize
95KB

MD5
7cdbaca31739500aefc06dd85a8558ff

SHA1
adc36ec6a3cdc7e57a1b706c820e382627f6cb90

SHA256
0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

SHA512
6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

Filesize
301KB

MD5
07f4bbf18077231cb44750684dd8daf4

SHA1
8560627e9e05d6022abdfe7e576856e91ac90188

SHA256
4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

SHA512
04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

Filesize
301KB

MD5
07f4bbf18077231cb44750684dd8daf4

SHA1
8560627e9e05d6022abdfe7e576856e91ac90188

SHA256
4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

SHA512
04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

Filesize
301KB

MD5
07f4bbf18077231cb44750684dd8daf4

SHA1
8560627e9e05d6022abdfe7e576856e91ac90188

SHA256
4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

SHA512
04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

Filesize
4.3MB

MD5
055ae7c584a7b012955bf5d874f30cfa

SHA1
f2b4d8c5307ff09607be929ec08fc2727bf03dcf

SHA256
d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

SHA512
910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

Filesize
4.3MB

MD5
055ae7c584a7b012955bf5d874f30cfa

SHA1
f2b4d8c5307ff09607be929ec08fc2727bf03dcf

SHA256
d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

SHA512
910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

Filesize
135KB

MD5
f08b1f044c68770c190daf1eb1f3157e

SHA1
f94103a542459d60434f9ddb6b5f45b11eae2923

SHA256
1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

SHA512
0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

Filesize
135KB

MD5
f08b1f044c68770c190daf1eb1f3157e

SHA1
f94103a542459d60434f9ddb6b5f45b11eae2923

SHA256
1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

SHA512
0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc

Filesize
227B

MD5
17c2994d6a89cb7d277f1b3f0b49e5ed

SHA1
2a72ffc34cb2a7d7d3057f4725f2ac660a809158

SHA256
38ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f

SHA512
d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ad1685f820a2f6b4823d96d327fdca71

SHA1
382f71c7ac5ac0f69b88d67cd180879743aed8b1

SHA256
4cce7d30bcd96bd1b5a26592186eb5811581cfba04528ed092156c291ecfef8a

SHA512
d106e67d889b0271e9cc66a779201e7861e0c1793c08b67894aec6ef3677edf9a97a219f21aa349d319eed7944134f0f918355c0a4f876433c5dea8c0dde8807

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
6159ef2c0f3f8cf85b882179223d319c

SHA1
504730da535c4be8c8af72722bf8b54f5c687c1c

SHA256
a87ecf6238fdc4ed459a2c653e733c9cc25c0596f4a5b55f028280e909c59b64

SHA512
a4353f27df4f9a1291a4e933f96f74d05a3e9ad0cbb9b42720163806c3047ab497875fec51931d7959f48f4042200d15293df736216db430add3e40e70c5897e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
79d95551d43a63dbc48d2d777f71d2d5

SHA1
3e6cd93a3f87cc02fba5705da4c7015fda62a192

SHA256
db5982615b3cbf979db3fdbc6d1fc3fdc46dca7e9f4d232e59ffae9852d62179

SHA512
e12336c659a62c9af283ff0a71013c87561499993c018d40fe7c340d447ade68e271a79da770efd285bd20d8bea6e7afb49a2b737c6da3f5e16401fbd85c8548

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
dcfa5c35105b5de6d95fec686cd163f0

SHA1
8f8e9ace95da7399adf87412b3fb0d50a3650934

SHA256
13cdb4cf1b6869e2b742a07c7c7c9b4953ff7044dc0bff30c9e3a0d2dc549ead

SHA512
f10976ee2891c4ae5f96006246f83105b4f5632e0715d3878c0688e67767f41ff4812dae092052429905f0387bf482c5cbed781d750f9eb97caf147a4b4b236b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
a42fc59de14f9bf81ece0ea247660921

SHA1
f8da1168cac5d2d89dceecf9f512a9536d1d3395

SHA256
c43606d76cbf80268f6616de64e8d42a57afe36109417b4a9a94b289e7c9226c

SHA512
6076d2b56ca8d79a18444f0b68990f4d88de63245ee8a3c5273476b86b9baf1317b70838a797c1d13434807220e6268f362b0d59bdf0ec0e5af3b51bb7d9b43b

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
9132a875875f7e0f37afe0376c0a276d

SHA1
43dc298e643fda93d98835e4a2f8a0b7b9828c1b

SHA256
1f4918f590e74fb1b84700ef8962fad2e98dcafa7f490103821013b119b85868

SHA512
e6050ef994f1df011f1fba481d525a264f9eb06f55166bddf2d07c1758869dd937e1428e79f34342dd27c85662f72732efcd5e9598fcb4b470fdf290fbba1d70

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
9132a875875f7e0f37afe0376c0a276d

SHA1
43dc298e643fda93d98835e4a2f8a0b7b9828c1b

SHA256
1f4918f590e74fb1b84700ef8962fad2e98dcafa7f490103821013b119b85868

SHA512
e6050ef994f1df011f1fba481d525a264f9eb06f55166bddf2d07c1758869dd937e1428e79f34342dd27c85662f72732efcd5e9598fcb4b470fdf290fbba1d70

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1880-411-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1880-403-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2032-195-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2032-207-0x000000007F540000-0x000000007F550000-memory.dmp

Filesize
64KB

Download
memory/2032-197-0x0000000070760000-0x0000000070AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2032-196-0x000000006FFC0000-0x000000007000C000-memory.dmp

Filesize
304KB

Download
memory/2032-194-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2032-193-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/2300-177-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/2300-208-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/2300-134-0x0000000005130000-0x0000000005A1B000-memory.dmp

Filesize
8.9MB

Download
memory/2300-152-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/2816-484-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2816-470-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3228-283-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/3228-282-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/3228-297-0x000000007F8A0000-0x000000007F8B0000-memory.dmp

Filesize
64KB

Download
memory/3228-296-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/3228-286-0x0000000070140000-0x0000000070494000-memory.dmp

Filesize
3.3MB

Download
memory/3228-285-0x000000006FFC0000-0x000000007000C000-memory.dmp

Filesize
304KB

Download
memory/3608-222-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/3608-183-0x0000000005170000-0x0000000005A5B000-memory.dmp

Filesize
8.9MB

Download
memory/3608-271-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/3608-265-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/3880-351-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3880-341-0x0000000070690000-0x00000000709E4000-memory.dmp

Filesize
3.3MB

Download
memory/3880-340-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

Filesize
304KB

Download
memory/3880-329-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3880-352-0x000000007F440000-0x000000007F450000-memory.dmp

Filesize
64KB

Download
memory/3880-328-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3952-301-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/3952-314-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

Filesize
304KB

Download
memory/3952-315-0x00000000702E0000-0x0000000070634000-memory.dmp

Filesize
3.3MB

Download
memory/3952-325-0x000000007F6C0000-0x000000007F6D0000-memory.dmp

Filesize
64KB

Download
memory/3952-300-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/3952-313-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/4388-226-0x000000006FFC0000-0x000000007000C000-memory.dmp

Filesize
304KB

Download
memory/4388-237-0x000000007F4A0000-0x000000007F4B0000-memory.dmp

Filesize
64KB

Download
memory/4388-227-0x0000000070160000-0x00000000704B4000-memory.dmp

Filesize
3.3MB

Download
memory/4388-223-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4388-224-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4388-225-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4548-353-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-460-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-471-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-485-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-361-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-312-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-449-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4548-413-0x0000000000400000-0x00000000030D0000-memory.dmp

Filesize
44.8MB

Download
memory/4760-157-0x0000000007C50000-0x0000000007C6A000-memory.dmp

Filesize
104KB

Download
memory/4760-137-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4760-174-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4760-173-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4760-172-0x0000000007F50000-0x0000000007F5A000-memory.dmp

Filesize
40KB

Download
memory/4760-171-0x0000000007E00000-0x0000000007E1E000-memory.dmp

Filesize
120KB

Download
memory/4760-161-0x00000000706E0000-0x0000000070A34000-memory.dmp

Filesize
3.3MB

Download
memory/4760-160-0x000000006FFC0000-0x000000007000C000-memory.dmp

Filesize
304KB

Download
memory/4760-159-0x0000000007E20000-0x0000000007E52000-memory.dmp

Filesize
200KB

Download
memory/4760-135-0x0000000005270000-0x00000000052A6000-memory.dmp

Filesize
216KB

Download
memory/4760-136-0x00000000058E0000-0x0000000005F08000-memory.dmp

Filesize
6.2MB

Download
memory/4760-179-0x0000000007FF0000-0x0000000007FF8000-memory.dmp

Filesize
32KB

Download
memory/4760-158-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/4760-176-0x0000000007FB0000-0x0000000007FBE000-memory.dmp

Filesize
56KB

Download
memory/4760-156-0x00000000082A0000-0x000000000891A000-memory.dmp

Filesize
6.5MB

Download
memory/4760-155-0x0000000007B20000-0x0000000007B96000-memory.dmp

Filesize
472KB

Download
memory/4760-154-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4760-153-0x0000000006DB0000-0x0000000006DF4000-memory.dmp

Filesize
272KB

Download
memory/4760-151-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/4760-141-0x0000000006080000-0x00000000060E6000-memory.dmp

Filesize
408KB

Download
memory/4760-140-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/4760-139-0x0000000005830000-0x0000000005852000-memory.dmp

Filesize
136KB

Download
memory/4760-178-0x00000000080B0000-0x00000000080CA000-memory.dmp

Filesize
104KB

Download
memory/4760-175-0x0000000008010000-0x00000000080A6000-memory.dmp

Filesize
600KB

Download
memory/4760-138-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4764-401-0x0000000074630000-0x000000007465A000-memory.dmp

Filesize
168KB

Download
memory/4764-431-0x0000000074630000-0x000000007465A000-memory.dmp

Filesize
168KB

Download
memory/4764-486-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4764-400-0x0000000074730000-0x00000000747F1000-memory.dmp

Filesize
772KB

Download
memory/4764-461-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4764-433-0x0000000074540000-0x000000007458D000-memory.dmp

Filesize
308KB

Download
memory/4764-434-0x0000000074230000-0x0000000074531000-memory.dmp

Filesize
3.0MB

Download
memory/4764-426-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4764-402-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4764-450-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4764-430-0x0000000074660000-0x0000000074722000-memory.dmp

Filesize
776KB

Download
memory/4764-427-0x0000000074800000-0x000000007481E000-memory.dmp

Filesize
120KB

Download
memory/4764-432-0x0000000074590000-0x0000000074630000-memory.dmp

Filesize
640KB

Download
memory/4764-429-0x0000000074730000-0x00000000747F1000-memory.dmp

Filesize
772KB

Download
memory/4764-475-0x0000000000650000-0x0000000000A9E000-memory.dmp

Filesize
4.3MB

Download
memory/4872-263-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4872-264-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

Filesize
64KB

Download
memory/4872-253-0x0000000070740000-0x0000000070A94000-memory.dmp

Filesize
3.3MB

Download
memory/4872-252-0x000000006FFC0000-0x000000007000C000-memory.dmp

Filesize
304KB

Download
memory/4872-251-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4872-250-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download