Analysis
-
max time kernel
300s -
max time network
184s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08-06-2023 04:31
Static task
static1
Behavioral task
behavioral1
Sample
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe
Resource
win7-20230220-en
General
-
Target
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe
-
Size
4.2MB
-
MD5
1d5c8c5f65ece8bd6c534c2a4dab103f
-
SHA1
cb982786f558208767bc171a4c3b718b0db0ce3f
-
SHA256
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
-
SHA512
92d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
SSDEEP
98304:rPc9FcYO05ihGHS9WSnwj8q/RLdadqz/Y0RFELZvszSs:7c3EciILSnqdBdamY0RyeWs
Malware Config
Signatures
-
Glupteba payload 13 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-120-0x0000000004C40000-0x000000000552B000-memory.dmp family_glupteba behavioral2/memory/4108-315-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4108-417-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2416-667-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2416-1002-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2416-1151-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1415-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1864-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1890-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1898-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1900-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1902-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4144-1911-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba -
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 4144 csrss.exe 1300 injector.exe 5076 windefender.exe 2180 windefender.exe 4788 f801950a962ddba14caaa44bf084b55c.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/5076-1895-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/5076-1897-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2180-1899-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral2/memory/4788-1909-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral2/memory/2180-1910-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4788-1912-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe File created C:\Windows\rss\csrss.exe 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1944 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3320 schtasks.exe 3552 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exenetsh.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4480 powershell.exe 4480 powershell.exe 4480 powershell.exe 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 164 powershell.exe 164 powershell.exe 164 powershell.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 3332 powershell.exe 3332 powershell.exe 3332 powershell.exe 1264 powershell.exe 1264 powershell.exe 1264 powershell.exe 500 powershell.exe 500 powershell.exe 500 powershell.exe 4924 powershell.exe 4924 powershell.exe 4924 powershell.exe 3912 powershell.exe 3912 powershell.exe 3912 powershell.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 4144 csrss.exe 4144 csrss.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 4144 csrss.exe 4144 csrss.exe 1300 injector.exe 1300 injector.exe 4144 csrss.exe 4144 csrss.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe 1300 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4480 powershell.exe Token: SeDebugPrivilege 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Token: SeImpersonatePrivilege 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Token: SeDebugPrivilege 164 powershell.exe Token: SeDebugPrivilege 3332 powershell.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 500 powershell.exe Token: SeDebugPrivilege 4924 powershell.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeSystemEnvironmentPrivilege 4144 csrss.exe Token: SeSecurityPrivilege 1944 sc.exe Token: SeSecurityPrivilege 1944 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4108 wrote to memory of 4480 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 4108 wrote to memory of 4480 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 4108 wrote to memory of 4480 4108 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 164 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 164 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 164 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 4388 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe cmd.exe PID 2416 wrote to memory of 4388 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe cmd.exe PID 4388 wrote to memory of 4912 4388 cmd.exe netsh.exe PID 4388 wrote to memory of 4912 4388 cmd.exe netsh.exe PID 2416 wrote to memory of 3332 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 3332 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 3332 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 1264 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 1264 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 1264 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2416 wrote to memory of 4144 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 2416 wrote to memory of 4144 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 2416 wrote to memory of 4144 2416 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 4144 wrote to memory of 500 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 500 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 500 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 4924 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 4924 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 4924 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 3912 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 3912 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 3912 4144 csrss.exe powershell.exe PID 4144 wrote to memory of 1300 4144 csrss.exe injector.exe PID 4144 wrote to memory of 1300 4144 csrss.exe injector.exe PID 5076 wrote to memory of 4960 5076 windefender.exe cmd.exe PID 5076 wrote to memory of 4960 5076 windefender.exe cmd.exe PID 5076 wrote to memory of 4960 5076 windefender.exe cmd.exe PID 4960 wrote to memory of 1944 4960 cmd.exe sc.exe PID 4960 wrote to memory of 1944 4960 cmd.exe sc.exe PID 4960 wrote to memory of 1944 4960 cmd.exe sc.exe PID 4144 wrote to memory of 4788 4144 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 4144 wrote to memory of 4788 4144 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 4144 wrote to memory of 4788 4144 csrss.exe f801950a962ddba14caaa44bf084b55c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qbg4k4j4.hqe.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5c1a2bd8917504922edd8dbbefb632d7c
SHA1cb010bc9f437c4256e2ce888129aacf7da974177
SHA2563d4eab632f345efeb9e47316d504f30b98a8a4483e73d81eefee4776eb63c90c
SHA51249281e061f048dc7c11669d3cbc345591708f12f6c29aad964ef139b55b73f3483a7a2763cead5734c0ac568839016e0ee3296be163a52d8479260958119ab1a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5cf064e661a739a24c7b77c8896e3b9b0
SHA1d5e453aa833df7312e5527bb31b7515dbf01e5df
SHA2562d45fcca8ae7daf68ba4022ee27dcb2b342659069d183a3994958489ea3ed793
SHA512a86f18a3cc00fc4a02779e659ec3795be35ad910f25213f76d3d161383e24c2fd314517aef9a17ac66439493dc9d651d421fd7882e7ce18a5fa201d09e19440c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5a34a7699dcbf2b5f878384e8e17032ea
SHA17d6f20373d57323bc0614975a1b3454492f2d042
SHA2563aa45ccc74bff7a699fed23ab3a4f07f1d405caec90d38bfa5a9f8f69312685e
SHA512cfdb95c0de1b6b4999672263f8df54c0610b3a6b9352c300bf97539991cb9e8d7fd3a2473b284d5ba342c0b77aec3a991dd8558633728612c8fdbddb0e5463f7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5e511d2b3a6c411b9b239b03ed8a452f2
SHA19442bf70ad4bfdc2253b41b92e8d323b4b829b03
SHA256db50f9564fc3ce0e70966ef020ace701e6d51cd75ff3afb78bfd464b975a8619
SHA51234d42bd09b3ee66ce1ad4e0ed93f6642a34196b0885163673e70b7b697baa3199e2c2aff90baec5e457751c3d47ac5efd556b9fefbddd8c68fbc4f2452f6b2b7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD50aafc477b353cd956f97b59ba9bc256a
SHA1dbdfd3445d92a04079e36b2dd1cc56739620f60e
SHA25696275e7e88cefca3afe21430f5ca429207cc8fa4039761b79771484e4dff3947
SHA51220ebf17522b9bdfe5ac76ceeb8a10007bc1753dfc663af52e3e9bb113ab18fadfb6db36adaf0339c8efdf5621c07178069d8484e58beb550e32ddf0d06373df5
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51d5c8c5f65ece8bd6c534c2a4dab103f
SHA1cb982786f558208767bc171a4c3b718b0db0ce3f
SHA2568308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
SHA51292d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51d5c8c5f65ece8bd6c534c2a4dab103f
SHA1cb982786f558208767bc171a4c3b718b0db0ce3f
SHA2568308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
SHA51292d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/164-447-0x0000000009760000-0x0000000009805000-memory.dmpFilesize
660KB
-
memory/164-421-0x0000000007E30000-0x0000000008180000-memory.dmpFilesize
3.3MB
-
memory/164-449-0x0000000006F70000-0x0000000006F80000-memory.dmpFilesize
64KB
-
memory/164-448-0x000000007E990000-0x000000007E9A0000-memory.dmpFilesize
64KB
-
memory/164-424-0x0000000008470000-0x00000000084BB000-memory.dmpFilesize
300KB
-
memory/164-423-0x0000000006F70000-0x0000000006F80000-memory.dmpFilesize
64KB
-
memory/164-422-0x0000000006F70000-0x0000000006F80000-memory.dmpFilesize
64KB
-
memory/500-1252-0x000000007F040000-0x000000007F050000-memory.dmpFilesize
64KB
-
memory/500-1160-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/500-1183-0x00000000097E0000-0x0000000009885000-memory.dmpFilesize
660KB
-
memory/500-1156-0x0000000007BA0000-0x0000000007EF0000-memory.dmpFilesize
3.3MB
-
memory/500-1159-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/500-1158-0x0000000008280000-0x00000000082CB000-memory.dmpFilesize
300KB
-
memory/500-1253-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/1264-910-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/1264-1003-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/1264-931-0x000000007EC80000-0x000000007EC90000-memory.dmpFilesize
64KB
-
memory/1264-909-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/2180-1910-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2180-1899-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2416-1151-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/2416-667-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/2416-1002-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3332-668-0x0000000006FE0000-0x0000000006FF0000-memory.dmpFilesize
64KB
-
memory/3332-708-0x000000007F240000-0x000000007F250000-memory.dmpFilesize
64KB
-
memory/3332-709-0x0000000006FE0000-0x0000000006FF0000-memory.dmpFilesize
64KB
-
memory/3332-669-0x0000000006FE0000-0x0000000006FF0000-memory.dmpFilesize
64KB
-
memory/3912-1648-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/3912-1702-0x000000007E6D0000-0x000000007E6E0000-memory.dmpFilesize
64KB
-
memory/3912-1649-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/3912-1704-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/4108-417-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4108-120-0x0000000004C40000-0x000000000552B000-memory.dmpFilesize
8.9MB
-
memory/4108-315-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1900-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1864-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1890-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1898-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1415-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1902-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4144-1911-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4480-132-0x0000000008500000-0x000000000854B000-memory.dmpFilesize
300KB
-
memory/4480-198-0x0000000006CE0000-0x0000000006CF0000-memory.dmpFilesize
64KB
-
memory/4480-406-0x0000000006CE0000-0x0000000006CF0000-memory.dmpFilesize
64KB
-
memory/4480-123-0x00000000047D0000-0x0000000004806000-memory.dmpFilesize
216KB
-
memory/4480-124-0x0000000007320000-0x0000000007948000-memory.dmpFilesize
6.2MB
-
memory/4480-125-0x0000000006CE0000-0x0000000006CF0000-memory.dmpFilesize
64KB
-
memory/4480-407-0x0000000006CE0000-0x0000000006CF0000-memory.dmpFilesize
64KB
-
memory/4480-397-0x0000000008460000-0x0000000008468000-memory.dmpFilesize
32KB
-
memory/4480-126-0x0000000006CE0000-0x0000000006CF0000-memory.dmpFilesize
64KB
-
memory/4480-182-0x0000000009120000-0x0000000009196000-memory.dmpFilesize
472KB
-
memory/4480-189-0x0000000009F50000-0x0000000009F83000-memory.dmpFilesize
204KB
-
memory/4480-190-0x0000000009F30000-0x0000000009F4E000-memory.dmpFilesize
120KB
-
memory/4480-195-0x0000000009F90000-0x000000000A035000-memory.dmpFilesize
660KB
-
memory/4480-196-0x000000000A160000-0x000000000A1F4000-memory.dmpFilesize
592KB
-
memory/4480-197-0x000000007FA30000-0x000000007FA40000-memory.dmpFilesize
64KB
-
memory/4480-131-0x0000000007C80000-0x0000000007C9C000-memory.dmpFilesize
112KB
-
memory/4480-130-0x0000000007D00000-0x0000000008050000-memory.dmpFilesize
3.3MB
-
memory/4480-151-0x0000000009060000-0x000000000909C000-memory.dmpFilesize
240KB
-
memory/4480-129-0x0000000007C10000-0x0000000007C76000-memory.dmpFilesize
408KB
-
memory/4480-392-0x00000000084B0000-0x00000000084CA000-memory.dmpFilesize
104KB
-
memory/4480-128-0x0000000007950000-0x00000000079B6000-memory.dmpFilesize
408KB
-
memory/4480-127-0x0000000007240000-0x0000000007262000-memory.dmpFilesize
136KB
-
memory/4788-1909-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4788-1912-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4924-1432-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4924-1430-0x000000007F480000-0x000000007F490000-memory.dmpFilesize
64KB
-
memory/4924-1428-0x0000000009BA0000-0x0000000009C45000-memory.dmpFilesize
660KB
-
memory/4924-1417-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4924-1416-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4924-1400-0x0000000008100000-0x0000000008450000-memory.dmpFilesize
3.3MB
-
memory/4924-1402-0x00000000089C0000-0x0000000008A0B000-memory.dmpFilesize
300KB
-
memory/5076-1897-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5076-1895-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB