Analysis
-
max time kernel
300s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08-06-2023 04:47
Static task
static1
Behavioral task
behavioral1
Sample
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe
Resource
win7-20230220-en
General
-
Target
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe
-
Size
4.2MB
-
MD5
1d5c8c5f65ece8bd6c534c2a4dab103f
-
SHA1
cb982786f558208767bc171a4c3b718b0db0ce3f
-
SHA256
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
-
SHA512
92d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
SSDEEP
98304:rPc9FcYO05ihGHS9WSnwj8q/RLdadqz/Y0RFELZvszSs:7c3EciILSnqdBdamY0RyeWs
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/4228-117-0x0000000004DF0000-0x00000000056DB000-memory.dmp family_glupteba behavioral2/memory/4228-266-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/4228-414-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2500-660-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2500-1081-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/2500-1147-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1402-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1740-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1888-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1897-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1899-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1901-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1903-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1905-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1907-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1909-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1911-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba behavioral2/memory/3528-1920-0x0000000000400000-0x000000000295A000-memory.dmp family_glupteba -
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 3528 csrss.exe 3804 injector.exe 2728 windefender.exe 508 windefender.exe 4756 f801950a962ddba14caaa44bf084b55c.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/2728-1893-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx behavioral2/memory/2728-1895-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/508-1896-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/508-1902-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/508-1908-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral2/memory/4756-1918-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral2/memory/508-1919-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4756-1921-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe File created C:\Windows\rss\csrss.exe 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1268 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3328 schtasks.exe 3000 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4920 powershell.exe 4920 powershell.exe 4920 powershell.exe 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 3496 powershell.exe 3496 powershell.exe 3496 powershell.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe 4960 powershell.exe 4960 powershell.exe 4960 powershell.exe 4172 powershell.exe 4172 powershell.exe 4172 powershell.exe 2804 powershell.exe 2804 powershell.exe 2804 powershell.exe 3256 powershell.exe 3256 powershell.exe 3256 powershell.exe 4772 powershell.exe 4772 powershell.exe 4772 powershell.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3528 csrss.exe 3528 csrss.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3528 csrss.exe 3528 csrss.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3528 csrss.exe 3528 csrss.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe 3804 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4920 powershell.exe Token: SeDebugPrivilege 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Token: SeImpersonatePrivilege 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeSystemEnvironmentPrivilege 3528 csrss.exe Token: SeSecurityPrivilege 1268 sc.exe Token: SeSecurityPrivilege 1268 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4228 wrote to memory of 4920 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 4228 wrote to memory of 4920 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 4228 wrote to memory of 4920 4228 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 3496 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 3496 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 3496 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 1772 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe cmd.exe PID 2500 wrote to memory of 1772 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe cmd.exe PID 1772 wrote to memory of 4948 1772 cmd.exe netsh.exe PID 1772 wrote to memory of 4948 1772 cmd.exe netsh.exe PID 2500 wrote to memory of 4960 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 4960 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 4960 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 4172 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 4172 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 4172 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe powershell.exe PID 2500 wrote to memory of 3528 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 2500 wrote to memory of 3528 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 2500 wrote to memory of 3528 2500 8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe csrss.exe PID 3528 wrote to memory of 2804 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 2804 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 2804 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 3256 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 3256 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 3256 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 4772 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 4772 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 4772 3528 csrss.exe powershell.exe PID 3528 wrote to memory of 3804 3528 csrss.exe injector.exe PID 3528 wrote to memory of 3804 3528 csrss.exe injector.exe PID 2728 wrote to memory of 4716 2728 windefender.exe cmd.exe PID 2728 wrote to memory of 4716 2728 windefender.exe cmd.exe PID 2728 wrote to memory of 4716 2728 windefender.exe cmd.exe PID 4716 wrote to memory of 1268 4716 cmd.exe sc.exe PID 4716 wrote to memory of 1268 4716 cmd.exe sc.exe PID 4716 wrote to memory of 1268 4716 cmd.exe sc.exe PID 3528 wrote to memory of 4756 3528 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 3528 wrote to memory of 4756 3528 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 3528 wrote to memory of 4756 3528 csrss.exe f801950a962ddba14caaa44bf084b55c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"C:\Users\Admin\AppData\Local\Temp\8308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1otxknrn.3og.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD535031ae8d624e70eeee73df5e647739e
SHA164f0fed8db3f787471cf758375054a0f8c686dde
SHA256307b7a5108a69b94749cb9d4c16afb8d326209f655dacb5a03f2dcd59c04cff1
SHA512e863b1e02786bdd109e61dc9c14cfa01956f951b68ab0911bd41524f1b09d66cfd7a20a77f7fe2310bfa7bfbd91d3410eff27b5317786357dedaeb68cdece5a1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD53505d924a83e010ab801ae624e9c97c8
SHA11c3e208ab9c96b4ceb770b507481c7e3551ab670
SHA256f20b1e90be1b61a59f5add5afe5207c93ed5a72114aefb25338be9a72f2e2015
SHA512191aae31d9b04b861660c9c7dde033b512a7f1b68690694cb5bd18f877df84633f1cded3d19cbc262c22cd3e1a3116f1acc42d54bbb51cf03775b5bae7e09a1e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5d04d2980809907ef1969d6236c29d134
SHA10ef65915304c5c62c65604021f1e56b78a6e1a73
SHA256162bfd4bd06390fa1be9b6a64daa4e0d56e1887fe77e8f98c74dcd2450cd5184
SHA5123edb8e8753bc5dba006d0ce2f969f1f5b9d6639723dbdbd7167bef0c61b9e4085fdf506dcc41d747c96006acf4858874be0ab1ff8d296ccdb5b4605aa791793a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD58b2ba5bc5a8d60e48caac28e4d0711d7
SHA104117cc30406380d8e4f653c9f821d5adf4ecc09
SHA256192aa0982008518a72f42b4ad5c07528e6299b231bfea29fb1e259cebcf3610e
SHA512cc7f496a2b3dd8269b1b39a02b30ad0f1af98a64d6a5aa333e993dd874ab61ae4603911e89d1190c1a9bb84ad204426c2c1843e79ecf225e3327bc9642b22e74
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD516c92c3eb1b1ae15ae29bd79b9927922
SHA1fbc4de61b7bcf289a8fc9488021ef17437beb3a9
SHA25699256162d6494a7aedf05f0530452c95e37656064df09fab02a2e68b06e0e0e0
SHA5125df5aceb618ffbc448b15af3d63d547a4f94d2af7cb0443a8c23018630ae26e6c1d64907ba832edace16af087c017c67b029db60f9a4b0a5c195f2a1197babb5
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51d5c8c5f65ece8bd6c534c2a4dab103f
SHA1cb982786f558208767bc171a4c3b718b0db0ce3f
SHA2568308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
SHA51292d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51d5c8c5f65ece8bd6c534c2a4dab103f
SHA1cb982786f558208767bc171a4c3b718b0db0ce3f
SHA2568308179514d386fba1356aa4459f46f925d4a5b9a6f36733154d183c0780ac93
SHA51292d814721e2a699ca50dc2a8da642d9f405c09efb7731103624eaede318b46f4803e8501aa8437b70040a8da10b97b81d64023c0111b03339a5c96f7c2c665ae
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/508-1908-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/508-1896-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/508-1902-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/508-1919-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2500-1081-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/2500-660-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/2500-1147-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/2728-1895-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2728-1893-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2804-1153-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/2804-1155-0x00000000074D0000-0x0000000007820000-memory.dmpFilesize
3.3MB
-
memory/2804-1186-0x000000007E910000-0x000000007E920000-memory.dmpFilesize
64KB
-
memory/2804-1157-0x0000000007E50000-0x0000000007E9B000-memory.dmpFilesize
300KB
-
memory/2804-1180-0x0000000008A80000-0x0000000008B25000-memory.dmpFilesize
660KB
-
memory/2804-1187-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/2804-1154-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/3256-1428-0x000000007EF00000-0x000000007EF10000-memory.dmpFilesize
64KB
-
memory/3256-1397-0x00000000077C0000-0x0000000007B10000-memory.dmpFilesize
3.3MB
-
memory/3256-1429-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3256-1425-0x00000000092B0000-0x0000000009355000-memory.dmpFilesize
660KB
-
memory/3256-1412-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3256-1411-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/3256-1399-0x00000000070C0000-0x000000000710B000-memory.dmpFilesize
300KB
-
memory/3496-421-0x0000000007C10000-0x0000000007C5B000-memory.dmpFilesize
300KB
-
memory/3496-418-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/3496-419-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/3496-420-0x0000000007490000-0x00000000077E0000-memory.dmpFilesize
3.3MB
-
memory/3496-514-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/3496-444-0x0000000008DF0000-0x0000000008E95000-memory.dmpFilesize
660KB
-
memory/3496-445-0x000000007EF90000-0x000000007EFA0000-memory.dmpFilesize
64KB
-
memory/3528-1740-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1907-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1888-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1897-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1899-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1901-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1920-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1402-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1911-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1903-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1909-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/3528-1905-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4172-930-0x000000007ED80000-0x000000007ED90000-memory.dmpFilesize
64KB
-
memory/4172-906-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/4172-907-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/4172-931-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/4228-414-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4228-266-0x0000000000400000-0x000000000295A000-memory.dmpFilesize
37.4MB
-
memory/4228-117-0x0000000004DF0000-0x00000000056DB000-memory.dmpFilesize
8.9MB
-
memory/4756-1918-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4756-1921-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4772-1714-0x000000007F350000-0x000000007F360000-memory.dmpFilesize
64KB
-
memory/4772-1642-0x0000000008080000-0x00000000083D0000-memory.dmpFilesize
3.3MB
-
memory/4772-1645-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4772-1644-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4772-1715-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4920-193-0x000000007EBA0000-0x000000007EBB0000-memory.dmpFilesize
64KB
-
memory/4920-124-0x0000000007590000-0x00000000075B2000-memory.dmpFilesize
136KB
-
memory/4920-179-0x00000000094A0000-0x0000000009516000-memory.dmpFilesize
472KB
-
memory/4920-192-0x000000000A2F0000-0x000000000A395000-memory.dmpFilesize
660KB
-
memory/4920-148-0x00000000093E0000-0x000000000941C000-memory.dmpFilesize
240KB
-
memory/4920-129-0x0000000008350000-0x000000000839B000-memory.dmpFilesize
300KB
-
memory/4920-128-0x0000000008320000-0x000000000833C000-memory.dmpFilesize
112KB
-
memory/4920-127-0x0000000007FA0000-0x00000000082F0000-memory.dmpFilesize
3.3MB
-
memory/4920-126-0x0000000007CB0000-0x0000000007D16000-memory.dmpFilesize
408KB
-
memory/4920-125-0x0000000007D90000-0x0000000007DF6000-memory.dmpFilesize
408KB
-
memory/4920-187-0x000000000A290000-0x000000000A2AE000-memory.dmpFilesize
120KB
-
memory/4920-194-0x000000000A500000-0x000000000A594000-memory.dmpFilesize
592KB
-
memory/4920-263-0x0000000007040000-0x0000000007050000-memory.dmpFilesize
64KB
-
memory/4920-186-0x000000000A2B0000-0x000000000A2E3000-memory.dmpFilesize
204KB
-
memory/4920-389-0x00000000071C0000-0x00000000071DA000-memory.dmpFilesize
104KB
-
memory/4920-394-0x00000000071B0000-0x00000000071B8000-memory.dmpFilesize
32KB
-
memory/4920-411-0x0000000007040000-0x0000000007050000-memory.dmpFilesize
64KB
-
memory/4920-123-0x0000000007040000-0x0000000007050000-memory.dmpFilesize
64KB
-
memory/4920-412-0x0000000007040000-0x0000000007050000-memory.dmpFilesize
64KB
-
memory/4920-120-0x0000000004E70000-0x0000000004EA6000-memory.dmpFilesize
216KB
-
memory/4920-122-0x0000000007040000-0x0000000007050000-memory.dmpFilesize
64KB
-
memory/4920-121-0x0000000007680000-0x0000000007CA8000-memory.dmpFilesize
6.2MB
-
memory/4960-666-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/4960-665-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/4960-686-0x000000007EF50000-0x000000007EF60000-memory.dmpFilesize
64KB
-
memory/4960-758-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB