Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
07-06-2023 19:43
Static task
static1
General
-
Target
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe
-
Size
4.2MB
-
MD5
c984bf9bb0d65804b93149ea27ab76af
-
SHA1
b3bd788c92be1f336e9590731d63bec71801c54c
-
SHA256
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960
-
SHA512
c15c26623c7d61a473306107379027e927210abbe8fa363dd40bf314d96fdd579ecdf2a9d7a37e92a6ddacf356f56c5949422a351efe5f4277737dfb822396c0
-
SSDEEP
98304:N7xlQWUQJrx/VpUx5jTm4qCa4aWdF3j0chnIX4rRA:Bxqd9YP+rjRfVA
Malware Config
Signatures
-
Glupteba payload 13 IoCs
Processes:
resource yara_rule behavioral1/memory/5040-120-0x0000000004D10000-0x00000000055FB000-memory.dmp family_glupteba behavioral1/memory/5040-197-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/5040-416-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/3636-651-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/3636-922-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/3636-1148-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1414-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1737-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1888-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1896-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1899-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1901-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral1/memory/4116-1910-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba -
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 4116 csrss.exe 5064 injector.exe 4972 windefender.exe 4440 windefender.exe 1248 f801950a962ddba14caaa44bf084b55c.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral1/memory/4972-1894-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4440-1895-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral1/memory/4440-1906-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1248-1907-0x0000000000400000-0x0000000000C25000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral1/memory/4440-1909-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1248-1911-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe -
Drops file in Windows directory 4 IoCs
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe File created C:\Windows\rss\csrss.exe 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3824 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2612 schtasks.exe 4408 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exepowershell.exe6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2232 powershell.exe 2232 powershell.exe 2232 powershell.exe 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 2500 powershell.exe 2500 powershell.exe 2500 powershell.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe 808 powershell.exe 808 powershell.exe 808 powershell.exe 4624 powershell.exe 4624 powershell.exe 4624 powershell.exe 2464 powershell.exe 2464 powershell.exe 2464 powershell.exe 1848 powershell.exe 1848 powershell.exe 1848 powershell.exe 3432 powershell.exe 3432 powershell.exe 3432 powershell.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 4116 csrss.exe 4116 csrss.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 4116 csrss.exe 4116 csrss.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 4116 csrss.exe 4116 csrss.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe 5064 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Token: SeImpersonatePrivilege 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 808 powershell.exe Token: SeDebugPrivilege 4624 powershell.exe Token: SeDebugPrivilege 2464 powershell.exe Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 3432 powershell.exe Token: SeSystemEnvironmentPrivilege 4116 csrss.exe Token: SeSecurityPrivilege 3824 sc.exe Token: SeSecurityPrivilege 3824 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 5040 wrote to memory of 2232 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 5040 wrote to memory of 2232 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 5040 wrote to memory of 2232 5040 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 2500 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 2500 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 2500 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 5028 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe cmd.exe PID 3636 wrote to memory of 5028 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe cmd.exe PID 5028 wrote to memory of 1144 5028 cmd.exe netsh.exe PID 5028 wrote to memory of 1144 5028 cmd.exe netsh.exe PID 3636 wrote to memory of 808 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 808 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 808 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 4624 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 4624 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 4624 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe powershell.exe PID 3636 wrote to memory of 4116 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe csrss.exe PID 3636 wrote to memory of 4116 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe csrss.exe PID 3636 wrote to memory of 4116 3636 6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe csrss.exe PID 4116 wrote to memory of 2464 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 2464 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 2464 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 1848 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 1848 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 1848 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 3432 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 3432 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 3432 4116 csrss.exe powershell.exe PID 4116 wrote to memory of 5064 4116 csrss.exe injector.exe PID 4116 wrote to memory of 5064 4116 csrss.exe injector.exe PID 4972 wrote to memory of 3856 4972 windefender.exe cmd.exe PID 4972 wrote to memory of 3856 4972 windefender.exe cmd.exe PID 4972 wrote to memory of 3856 4972 windefender.exe cmd.exe PID 3856 wrote to memory of 3824 3856 cmd.exe sc.exe PID 3856 wrote to memory of 3824 3856 cmd.exe sc.exe PID 3856 wrote to memory of 3824 3856 cmd.exe sc.exe PID 4116 wrote to memory of 1248 4116 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 4116 wrote to memory of 1248 4116 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 4116 wrote to memory of 1248 4116 csrss.exe f801950a962ddba14caaa44bf084b55c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe"C:\Users\Admin\AppData\Local\Temp\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe"C:\Users\Admin\AppData\Local\Temp\6d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eojw0sfn.1fk.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5b1fbc988a80a0c1a92f89653de5cfd41
SHA1a1e022dc2d40703cc6c5995d657b421ea96fcd38
SHA256f9d57125389f6884d64daa1564da42d2edb8b40cea35f72de0bef5da31b0fc04
SHA5121926b18d89c2ad4ee1b6ce2c3c74c9046536982a1f927857fc8282a82df3408ce56d51dd5cebcad4d3d555abc13219ce836867773fbd994e611e4b993e6957a3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD50e794268f93a730cfcc0d5e8e5b9ee8f
SHA15ec5d26ba518de49290cde306a00d77de43e857d
SHA25691c187eca88205584d78061c0dac907c3cfa6d7496ddd00928514d4a5a98ecb7
SHA512f7a31fc0b861a2eec72652513ef0dd25ccc5fb80ebbfbaa811aee3fd3571df9a9cd44a1c7c2b589e1ea6d5f759007fe8d7706f69b6e8d4e5c952e1a3ab663b1f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD550f122d8324e80708b5c55c667b9b940
SHA1bfa73c4db45346731c8d5b65f98307e9f48919f1
SHA256dd60fb3061ae9fad0113b079b3e48002cd2fcef8ee55524ca0397f48eb7d5a5e
SHA5122454184a424efb3596604114f3fbb14a1baa21554d6d5a594c9539709a27a3b486be3fe4217200d71bf8e16099dabcf26581e4a2c890d1061c246827d476b208
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD56c72a9c1be3e5161abc3240622dd466e
SHA175ea356fd90a8dbbe9d2160420f1f942b746a51b
SHA256d5582d02961b23e6e8125f6ef1261c61ede61b886066b22acbfd2a763a60218b
SHA5127939fd777164f062be1a1fab5556b3ff6326c5c32934b04a4dc11887d015ec0710b4d5c778840a18c77b831e221cede66071c08c5e8aefbf4a3542711d72afbf
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD53c07b77bf0c464b04975fb870118eb4c
SHA1c5914bd3c75bf763016a06720a4e3c08fe2fc695
SHA256772a0690be4b48c1993c507cdab33c8f93fb62971efb45ee7953c7fc9b81eef8
SHA512bb8b6190a9be46a046c96179ded02e39a4d678259c12e1b0f7cc90221d5da9da6db7417c7300f8b0f838e0b30f26fd10f3051e7b50b32654a0dc060a0431cb23
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5c984bf9bb0d65804b93149ea27ab76af
SHA1b3bd788c92be1f336e9590731d63bec71801c54c
SHA2566d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960
SHA512c15c26623c7d61a473306107379027e927210abbe8fa363dd40bf314d96fdd579ecdf2a9d7a37e92a6ddacf356f56c5949422a351efe5f4277737dfb822396c0
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5c984bf9bb0d65804b93149ea27ab76af
SHA1b3bd788c92be1f336e9590731d63bec71801c54c
SHA2566d8572814f7202696b984beba31a573226020b658522cb2429156ea4b07a8960
SHA512c15c26623c7d61a473306107379027e927210abbe8fa363dd40bf314d96fdd579ecdf2a9d7a37e92a6ddacf356f56c5949422a351efe5f4277737dfb822396c0
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/808-665-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/808-666-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/808-685-0x000000007F120000-0x000000007F130000-memory.dmpFilesize
64KB
-
memory/808-758-0x0000000007130000-0x0000000007140000-memory.dmpFilesize
64KB
-
memory/1248-1911-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/1248-1907-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/1848-1399-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/1848-1429-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/1848-1397-0x0000000008240000-0x0000000008590000-memory.dmpFilesize
3.3MB
-
memory/1848-1398-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/1848-1425-0x0000000009CE0000-0x0000000009D85000-memory.dmpFilesize
660KB
-
memory/1848-1427-0x000000007E5B0000-0x000000007E5C0000-memory.dmpFilesize
64KB
-
memory/1848-1401-0x0000000008770000-0x00000000087BB000-memory.dmpFilesize
300KB
-
memory/2232-393-0x0000000007E70000-0x0000000007E8A000-memory.dmpFilesize
104KB
-
memory/2232-129-0x0000000007430000-0x0000000007496000-memory.dmpFilesize
408KB
-
memory/2232-123-0x00000000045A0000-0x00000000045D6000-memory.dmpFilesize
216KB
-
memory/2232-124-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/2232-125-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/2232-126-0x0000000006CA0000-0x00000000072C8000-memory.dmpFilesize
6.2MB
-
memory/2232-127-0x0000000006BD0000-0x0000000006BF2000-memory.dmpFilesize
136KB
-
memory/2232-128-0x00000000073C0000-0x0000000007426000-memory.dmpFilesize
408KB
-
memory/2232-398-0x0000000007E60000-0x0000000007E68000-memory.dmpFilesize
32KB
-
memory/2232-130-0x0000000007790000-0x0000000007AE0000-memory.dmpFilesize
3.3MB
-
memory/2232-131-0x00000000075F0000-0x000000000760C000-memory.dmpFilesize
112KB
-
memory/2232-132-0x0000000007AE0000-0x0000000007B2B000-memory.dmpFilesize
300KB
-
memory/2232-151-0x0000000008010000-0x000000000804C000-memory.dmpFilesize
240KB
-
memory/2232-182-0x0000000008B80000-0x0000000008BF6000-memory.dmpFilesize
472KB
-
memory/2232-189-0x00000000099D0000-0x0000000009A03000-memory.dmpFilesize
204KB
-
memory/2232-270-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/2232-190-0x00000000099B0000-0x00000000099CE000-memory.dmpFilesize
120KB
-
memory/2232-195-0x0000000009A10000-0x0000000009AB5000-memory.dmpFilesize
660KB
-
memory/2232-196-0x0000000009BE0000-0x0000000009C74000-memory.dmpFilesize
592KB
-
memory/2232-201-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/2232-200-0x000000007E830000-0x000000007E840000-memory.dmpFilesize
64KB
-
memory/2464-1153-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2464-1180-0x0000000009580000-0x0000000009625000-memory.dmpFilesize
660KB
-
memory/2464-1222-0x000000007F420000-0x000000007F430000-memory.dmpFilesize
64KB
-
memory/2464-1224-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2464-1156-0x0000000008010000-0x000000000805B000-memory.dmpFilesize
300KB
-
memory/2464-1157-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2464-1154-0x00000000079D0000-0x0000000007D20000-memory.dmpFilesize
3.3MB
-
memory/2500-444-0x0000000008EF0000-0x0000000008F95000-memory.dmpFilesize
660KB
-
memory/2500-481-0x000000007FBA0000-0x000000007FBB0000-memory.dmpFilesize
64KB
-
memory/2500-421-0x0000000007A00000-0x0000000007A4B000-memory.dmpFilesize
300KB
-
memory/2500-420-0x00000000074D0000-0x0000000007820000-memory.dmpFilesize
3.3MB
-
memory/2500-482-0x0000000006860000-0x0000000006870000-memory.dmpFilesize
64KB
-
memory/3432-1642-0x0000000007E00000-0x0000000008150000-memory.dmpFilesize
3.3MB
-
memory/3432-1646-0x0000000006FB0000-0x0000000006FC0000-memory.dmpFilesize
64KB
-
memory/3432-1655-0x0000000006FB0000-0x0000000006FC0000-memory.dmpFilesize
64KB
-
memory/3432-1668-0x000000007F3D0000-0x000000007F3E0000-memory.dmpFilesize
64KB
-
memory/3432-1740-0x0000000006FB0000-0x0000000006FC0000-memory.dmpFilesize
64KB
-
memory/3636-1148-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3636-651-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3636-922-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1737-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1899-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1888-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1910-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1414-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1896-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4116-1901-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4440-1909-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4440-1906-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4440-1895-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4624-985-0x000000007F5A0000-0x000000007F5B0000-memory.dmpFilesize
64KB
-
memory/4624-986-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/4624-906-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/4624-907-0x0000000004880000-0x0000000004890000-memory.dmpFilesize
64KB
-
memory/4972-1898-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4972-1894-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5040-120-0x0000000004D10000-0x00000000055FB000-memory.dmpFilesize
8.9MB
-
memory/5040-416-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/5040-197-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB