Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    164s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 08:28

General

  • Target

    dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe

  • Size

    4.2MB

  • MD5

    3a9c8143ac63b230dc602a2c2f9372de

  • SHA1

    e8f01d5e448bbc46df3708c586c46da8bb4bf7d4

  • SHA256

    dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500

  • SHA512

    b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8

  • SSDEEP

    98304:jL+xkLfOKMBaabC2T6lDT99f560XhMLgDeYJUygu:HMkLaBfbp8XfbXWaJgu

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 20 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe
    "C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe
      "C:\Users\Admin\AppData\Local\Temp\dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1772
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4448
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4108
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4540
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:856
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4180
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4108
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2232
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2936
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2880
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:2240
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Windows\SysWOW64\sc.exe
              sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Launches sc.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:4892
    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:60
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_osjugjcp.o44.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus.tmp

      Filesize

      2.5MB

      MD5

      093fba54ad4880806ee9cb8d0a0f9097

      SHA1

      c3fb76aa4f14693481ff75c4d01ce3ebb1fc8838

      SHA256

      28e1566107c68af138e4eb900f01a8ac962bc918e57c9e62ae89c30537a9c17c

      SHA512

      23bdef893c6f93356d8d1c80f48b126d9139808f6611a4554c026772ada612b2140e7da1d46dbefaaa517477f29666ee464e59a899b03035f626cec62d777ea0

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

      Filesize

      4.7MB

      MD5

      9a1a2bf2682e72d64ec0dfec133ae0a8

      SHA1

      8b2bdab7b1d8a319e4896dbf8a3d55fb7022cc79

      SHA256

      80ccd95dc124775d2defac623b6305f0d6add2ae619ca66d378397b98cf10a41

      SHA512

      9fb50500a67cd45c8f8f60393047ad897a24928b8a4496612f6ead5383bc06527521f3812a5cf97f6444af3d884da81866482f84d78024719ffb696e14e9e015

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip

      Filesize

      3.8MB

      MD5

      c72911dec6ae8c4bc62bb2a6a21ba85b

      SHA1

      0ae7077313a53103c2b32100d74aafc04216289d

      SHA256

      7e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f

      SHA512

      99dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip6

      Filesize

      5.6MB

      MD5

      ed2f9b19dd1584d7e26f5ba460ef2fbf

      SHA1

      dcbf1789bf1eeb03276b830cb2ab92bcf779d97f

      SHA256

      f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add

      SHA512

      dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

      Filesize

      3.5MB

      MD5

      b7c32c8e7d21aa9b79470037227eba43

      SHA1

      38d719b10ca035cee65162c1a44e2c62123d41b4

      SHA256

      99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

      SHA512

      d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

      Filesize

      876KB

      MD5

      736443b08b5a52b6958f001e8200be71

      SHA1

      e56ddc8476aef0d3482c99c5bfaf0f57458b2576

      SHA256

      da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

      SHA512

      9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

      Filesize

      668KB

      MD5

      36e1c3814bde3418ba3d38517954cb7c

      SHA1

      495e1ba5b0b442e70124d33daa6fea4e3e5931b0

      SHA256

      b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

      SHA512

      df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

      Filesize

      938KB

      MD5

      d92e59b71bf8a0d827597ed95b2eca42

      SHA1

      cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

      SHA256

      b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

      SHA512

      be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

      Filesize

      95KB

      MD5

      7cdbaca31739500aefc06dd85a8558ff

      SHA1

      adc36ec6a3cdc7e57a1b706c820e382627f6cb90

      SHA256

      0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

      SHA512

      6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

      Filesize

      301KB

      MD5

      07f4bbf18077231cb44750684dd8daf4

      SHA1

      8560627e9e05d6022abdfe7e576856e91ac90188

      SHA256

      4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

      SHA512

      04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

      Filesize

      4.3MB

      MD5

      055ae7c584a7b012955bf5d874f30cfa

      SHA1

      f2b4d8c5307ff09607be929ec08fc2727bf03dcf

      SHA256

      d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

      SHA512

      910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

      Filesize

      135KB

      MD5

      f08b1f044c68770c190daf1eb1f3157e

      SHA1

      f94103a542459d60434f9ddb6b5f45b11eae2923

      SHA256

      1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

      SHA512

      0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

    • C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc

      Filesize

      227B

      MD5

      17c2994d6a89cb7d277f1b3f0b49e5ed

      SHA1

      2a72ffc34cb2a7d7d3057f4725f2ac660a809158

      SHA256

      38ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f

      SHA512

      d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      e3a433df6499cc7a7888b621b8f2bf93

      SHA1

      44c62d9441a5bf244889504ce16a9399ab286119

      SHA256

      039d75699bef7ed8ae4ddd438df46d586fba28663723f93191db4a8db85a4f0b

      SHA512

      3298c558bd36f66f98714e2482b200d0a8a3cc9a071b3a6d569f6c83caafb23efe51099dc7c45139dea6ed8bc77dbaf684964289f4037bf627b576fbe7dcae9d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      3a6b3638107061748ea56ecc3c481721

      SHA1

      05f8f83b84838734f097bbe675ae3583dffcb12e

      SHA256

      9a911eaf70cef5607887af79b265a8440c5d39acc44aa765bb054d224a3ebe61

      SHA512

      b42e5f9f01235012ce8b97ffbf9800d0a867070521c61b8115967205ca888cbea5530d955cb0481f9d4ead955dffcd918bb1032106035974e0bd16ab68e8ab7a

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      8d89551dbe2abb37cfb4b30295e78a09

      SHA1

      6b09edb736bd9eda3a1316b62d99c935f00553b2

      SHA256

      9ea70fa691dfbb014cc748189f4927613c4fb11efc038941e7c67060ee4db36f

      SHA512

      56e9768fe298a9c47c01d6231c06cf2e31b3d0bfb0251c2921890f81724f702cc0341c1fca65db0789ea1b6435ee0d3ee7589a8174de88d169285b794565f840

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      ccc45954d56455011b33b7e02d40282c

      SHA1

      4023125d389979905f0b2f252fb08a57b8e52681

      SHA256

      5e9f329399cf6e66628b2e450f14820e63481095fb5f6756d007272a6d49c009

      SHA512

      0388ef76ec3395b73a4542959a3d4b6640ac38e456026dc1711e5aaa39370f91a0c7f2977ce4253113fc603e995f2b8dda9ae0c79a026919fd36f481dfbb8ee2

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      865f0ad832d2c2fb0a2dacfa42811c1f

      SHA1

      c2daf1f40f62447c4b81266c9f1da180ca6698d3

      SHA256

      377e60411ea5c3b6f4752665bc2228390b24eebdda4b057e3280476e66e23548

      SHA512

      bb4909d85608d5fbe2d5392f8829cbed9abe500afc492185631124e33bffe32d5f9145e90b4e48498526d2276e1cdbd5379d8ee6aa0ff619b4a78955216ac1fb

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      3a9c8143ac63b230dc602a2c2f9372de

      SHA1

      e8f01d5e448bbc46df3708c586c46da8bb4bf7d4

      SHA256

      dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500

      SHA512

      b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      3a9c8143ac63b230dc602a2c2f9372de

      SHA1

      e8f01d5e448bbc46df3708c586c46da8bb4bf7d4

      SHA256

      dee6774ec0982bbdaca9fd3e8766e2ae76afb38b7d5856ae63b8738f04890500

      SHA512

      b0840df6d8388b0529e356649c25aaaf5c9180814dff44af7b9b5221057abe19ae84f3254c56db8987d11db33d7bea5c97d0c2b35df385dc4ec5eefcc5997ec8

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/60-346-0x0000000075420000-0x000000007543E000-memory.dmp

      Filesize

      120KB

    • memory/60-343-0x0000000075470000-0x0000000075531000-memory.dmp

      Filesize

      772KB

    • memory/60-351-0x0000000074F50000-0x0000000074F9D000-memory.dmp

      Filesize

      308KB

    • memory/60-387-0x0000000000D70000-0x00000000011BE000-memory.dmp

      Filesize

      4.3MB

    • memory/60-310-0x0000000075440000-0x000000007546A000-memory.dmp

      Filesize

      168KB

    • memory/60-312-0x0000000000D70000-0x00000000011BE000-memory.dmp

      Filesize

      4.3MB

    • memory/60-348-0x00000000752B0000-0x0000000075372000-memory.dmp

      Filesize

      776KB

    • memory/60-373-0x0000000000D70000-0x00000000011BE000-memory.dmp

      Filesize

      4.3MB

    • memory/60-347-0x0000000075380000-0x0000000075420000-memory.dmp

      Filesize

      640KB

    • memory/60-361-0x0000000000D70000-0x00000000011BE000-memory.dmp

      Filesize

      4.3MB

    • memory/60-349-0x0000000074FA0000-0x00000000752A1000-memory.dmp

      Filesize

      3.0MB

    • memory/60-341-0x0000000000D70000-0x00000000011BE000-memory.dmp

      Filesize

      4.3MB

    • memory/488-29-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/488-25-0x00000000029F0000-0x0000000002DF8000-memory.dmp

      Filesize

      4.0MB

    • memory/488-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/488-49-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/488-2-0x0000000002E00000-0x00000000036EB000-memory.dmp

      Filesize

      8.9MB

    • memory/488-28-0x0000000002E00000-0x00000000036EB000-memory.dmp

      Filesize

      8.9MB

    • memory/488-62-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/488-1-0x00000000029F0000-0x0000000002DF8000-memory.dmp

      Filesize

      4.0MB

    • memory/488-5-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-371-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-325-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-383-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-185-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-357-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/916-267-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/1772-95-0x0000000006F70000-0x0000000006F84000-memory.dmp

      Filesize

      80KB

    • memory/1772-81-0x0000000070D10000-0x0000000070D5C000-memory.dmp

      Filesize

      304KB

    • memory/1772-66-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/1772-67-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/1772-68-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/1772-94-0x0000000006F20000-0x0000000006F31000-memory.dmp

      Filesize

      68KB

    • memory/1772-78-0x0000000005600000-0x0000000005954000-memory.dmp

      Filesize

      3.3MB

    • memory/1772-93-0x0000000006C20000-0x0000000006CC3000-memory.dmp

      Filesize

      652KB

    • memory/1772-82-0x0000000070EB0000-0x0000000071204000-memory.dmp

      Filesize

      3.3MB

    • memory/1772-83-0x000000007F290000-0x000000007F2A0000-memory.dmp

      Filesize

      64KB

    • memory/1772-98-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/1772-79-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/2008-143-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/2008-132-0x0000000005940000-0x0000000005C94000-memory.dmp

      Filesize

      3.3MB

    • memory/2008-131-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/2008-130-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/2248-50-0x0000000007750000-0x00000000077E6000-memory.dmp

      Filesize

      600KB

    • memory/2248-23-0x0000000006010000-0x000000000605C000-memory.dmp

      Filesize

      304KB

    • memory/2248-4-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/2248-6-0x0000000002630000-0x0000000002666000-memory.dmp

      Filesize

      216KB

    • memory/2248-7-0x00000000026C0000-0x00000000026D0000-memory.dmp

      Filesize

      64KB

    • memory/2248-8-0x0000000005110000-0x0000000005738000-memory.dmp

      Filesize

      6.2MB

    • memory/2248-9-0x0000000004F50000-0x0000000004F72000-memory.dmp

      Filesize

      136KB

    • memory/2248-15-0x0000000004FF0000-0x0000000005056000-memory.dmp

      Filesize

      408KB

    • memory/2248-16-0x0000000005060000-0x00000000050C6000-memory.dmp

      Filesize

      408KB

    • memory/2248-21-0x00000000057E0000-0x0000000005B34000-memory.dmp

      Filesize

      3.3MB

    • memory/2248-22-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

      Filesize

      120KB

    • memory/2248-24-0x0000000006510000-0x0000000006554000-memory.dmp

      Filesize

      272KB

    • memory/2248-26-0x00000000026C0000-0x00000000026D0000-memory.dmp

      Filesize

      64KB

    • memory/2248-27-0x0000000007310000-0x0000000007386000-memory.dmp

      Filesize

      472KB

    • memory/2248-30-0x0000000007A10000-0x000000000808A000-memory.dmp

      Filesize

      6.5MB

    • memory/2248-61-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/2248-58-0x0000000007800000-0x0000000007808000-memory.dmp

      Filesize

      32KB

    • memory/2248-57-0x0000000007810000-0x000000000782A000-memory.dmp

      Filesize

      104KB

    • memory/2248-56-0x0000000007720000-0x0000000007734000-memory.dmp

      Filesize

      80KB

    • memory/2248-55-0x0000000007710000-0x000000000771E000-memory.dmp

      Filesize

      56KB

    • memory/2248-54-0x00000000026C0000-0x00000000026D0000-memory.dmp

      Filesize

      64KB

    • memory/2248-52-0x00000000026C0000-0x00000000026D0000-memory.dmp

      Filesize

      64KB

    • memory/2248-51-0x0000000007660000-0x0000000007671000-memory.dmp

      Filesize

      68KB

    • memory/2248-48-0x00000000076A0000-0x00000000076AA000-memory.dmp

      Filesize

      40KB

    • memory/2248-47-0x0000000007590000-0x0000000007633000-memory.dmp

      Filesize

      652KB

    • memory/2248-46-0x0000000006330000-0x000000000634E000-memory.dmp

      Filesize

      120KB

    • memory/2248-36-0x0000000071430000-0x0000000071784000-memory.dmp

      Filesize

      3.3MB

    • memory/2248-34-0x0000000070D10000-0x0000000070D5C000-memory.dmp

      Filesize

      304KB

    • memory/2248-35-0x00000000026C0000-0x00000000026D0000-memory.dmp

      Filesize

      64KB

    • memory/2248-31-0x0000000007390000-0x00000000073AA000-memory.dmp

      Filesize

      104KB

    • memory/2248-32-0x0000000007550000-0x0000000007582000-memory.dmp

      Filesize

      200KB

    • memory/2248-33-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/2404-352-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/2404-381-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3496-114-0x0000000003300000-0x0000000003310000-memory.dmp

      Filesize

      64KB

    • memory/3496-115-0x0000000070D10000-0x0000000070D5C000-memory.dmp

      Filesize

      304KB

    • memory/3496-101-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/3496-129-0x0000000074E70000-0x0000000075620000-memory.dmp

      Filesize

      7.7MB

    • memory/3496-118-0x0000000070EB0000-0x0000000071204000-memory.dmp

      Filesize

      3.3MB

    • memory/3496-103-0x0000000003300000-0x0000000003310000-memory.dmp

      Filesize

      64KB

    • memory/3496-117-0x000000007F260000-0x000000007F270000-memory.dmp

      Filesize

      64KB

    • memory/4704-322-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4748-102-0x0000000002A50000-0x0000000002E4A000-memory.dmp

      Filesize

      4.0MB

    • memory/4748-116-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4748-65-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4748-99-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4748-64-0x0000000002A50000-0x0000000002E4A000-memory.dmp

      Filesize

      4.0MB

    • memory/4748-164-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4748-159-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB