Analysis

  • max time kernel
    119s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 02:11

General

  • Target

    29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee.exe

  • Size

    161KB

  • MD5

    fb8ddd837ad8b94f1faf0b4920ce7b2b

  • SHA1

    c3bc51f18a1180be27c4ee0978aaa9e1295dbd4b

  • SHA256

    29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee

  • SHA512

    db218213ee139583f69b00ea7e33986857cbc73f0e549f996e0dc3b0b34282c838f874a65c13fa7e21adfb8d876ca6cef9421a19171c214b1ea98b1a99f1bc74

  • SSDEEP

    1536:IwYZ5gZyjech8y/nK/bobGPgeMWKQxljH3PBe/8YkfbM9Wzw1mE3SmJQENYmAzTa:YiZpyDz/WVPX/9CWz9xmJQMYmAzsX

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect ZGRat V1 1 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 9 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 8 IoCs
  • Detects executables Discord URL observed in first stage droppers 8 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 8 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee.exe
    "C:\Users\Admin\AppData\Local\Temp\29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:552
  • C:\Users\Admin\AppData\Local\Temp\C0C0.exe
    C:\Users\Admin\AppData\Local\Temp\C0C0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\C0C0.exe
      C:\Users\Admin\AppData\Local\Temp\C0C0.exe
      2⤵
      • DcRat
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:500
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\7df1bef0-3408-4ac0-ae86-00253b231c8e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4304
      • C:\Users\Admin\AppData\Local\Temp\C0C0.exe
        "C:\Users\Admin\AppData\Local\Temp\C0C0.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Users\Admin\AppData\Local\Temp\C0C0.exe
          "C:\Users\Admin\AppData\Local\Temp\C0C0.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:2292
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 568
            5⤵
            • Program crash
            PID:1628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2292 -ip 2292
    1⤵
      PID:3644
    • C:\Users\Admin\AppData\Local\Temp\88C4.exe
      C:\Users\Admin\AppData\Local\Temp\88C4.exe
      1⤵
      • Executes dropped EXE
      PID:2928
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8C7E.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:464
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:4492
      • C:\Users\Admin\AppData\Local\Temp\973D.exe
        C:\Users\Admin\AppData\Local\Temp\973D.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4920
        • C:\Users\Admin\AppData\Local\Temp\973D.exe
          "C:\Users\Admin\AppData\Local\Temp\973D.exe"
          2⤵
          • Executes dropped EXE
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:464
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1172
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:992
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:1700
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:832
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1356
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            3⤵
              PID:1692
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                  PID:436
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:468
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:2188
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                      PID:2656
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                        PID:2976
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        4⤵
                          PID:2808
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          4⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:1152
                        • C:\Windows\windefender.exe
                          "C:\Windows\windefender.exe"
                          4⤵
                            PID:3488
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              5⤵
                                PID:3372
                                • C:\Windows\SysWOW64\sc.exe
                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  6⤵
                                  • Launches sc.exe
                                  PID:3028
                      • C:\Users\Admin\AppData\Local\Temp\A363.exe
                        C:\Users\Admin\AppData\Local\Temp\A363.exe
                        1⤵
                        • Executes dropped EXE
                        PID:2920
                      • C:\Users\Admin\AppData\Local\Temp\336F.exe
                        C:\Users\Admin\AppData\Local\Temp\336F.exe
                        1⤵
                          PID:1480
                        • C:\Windows\windefender.exe
                          C:\Windows\windefender.exe
                          1⤵
                            PID:2696

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\336F.exe

                            Filesize

                            7.4MB

                            MD5

                            c96c8f6bb68d339098dbc8885d27007a

                            SHA1

                            880ab4e7a89e9a58056a6a6650fc3bca6beb8b77

                            SHA256

                            e132abb3e01c827c071cdcc5493929c49afa801198697e7539e42e8d05f06aa5

                            SHA512

                            c99de85da1ae9d460d0630f789325e40d49a9cd78fa150a61e72bd4185ec979b4a969332a46c2d994bbf1b0361f7cbc5bb0071a6a58ea3bd09f18b5ed5619758

                          • C:\Users\Admin\AppData\Local\Temp\88C4.exe

                            Filesize

                            6.7MB

                            MD5

                            74cf066c5c492eb825b36550b1e38326

                            SHA1

                            8f211213fbd6905b5e44bf2af07e481832198a7f

                            SHA256

                            24201da166b3e59a7a2b79f24881222c41e35f26642dd757fcc51ec47c9404e4

                            SHA512

                            24ad3ebb70332741959b13be504ec2b3baee9668bb3a8e8ae314432ac2e084ad11c03f4abfba6f7557273cddb1b3d2e2361c71246f3fd7fccabae218dd8b2e91

                          • C:\Users\Admin\AppData\Local\Temp\8C7E.bat

                            Filesize

                            77B

                            MD5

                            55cc761bf3429324e5a0095cab002113

                            SHA1

                            2cc1ef4542a4e92d4158ab3978425d517fafd16d

                            SHA256

                            d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                            SHA512

                            33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                          • C:\Users\Admin\AppData\Local\Temp\973D.exe

                            Filesize

                            4.1MB

                            MD5

                            1047d7617f162d488920965b0a8b876c

                            SHA1

                            059afd73ca2f9b7c358979a6f1cc99c5424281a2

                            SHA256

                            58b5bdc3cd4730734032dcc2dde7452889e6b6a12f3ae61e142df1121551859c

                            SHA512

                            698483dca1f3dc3a3056b041a7c70e1609d86dcc4dc9751b04a67810be19c999235372d1a07d5806459f51d513deab91524c6fccd83b554afc331914690b74ac

                          • C:\Users\Admin\AppData\Local\Temp\A363.exe

                            Filesize

                            2.7MB

                            MD5

                            33668fdebf254ddd8af3b6385f01e27e

                            SHA1

                            ef5ea8dde1042c56e4e5903d8fd0b6ca5227b29c

                            SHA256

                            c742cef343418e086d205992ba824ad79e74024b040ef3f3f600efd005ed7475

                            SHA512

                            f9a4d72636db09b88d21f6640a3884b8bc3a6a672c52b5dce99d6193cbc37211812af5cd034d381035795a60b19bb7fd352ec9f03d79bb0661c625f3a1a270c4

                          • C:\Users\Admin\AppData\Local\Temp\A363.exe

                            Filesize

                            2.6MB

                            MD5

                            618950cd2e0ce02df8b425c773d4b56e

                            SHA1

                            ef4fd4177dda63b61f12bcd073a9fa3cfa68bdbd

                            SHA256

                            d2efff8562fece66082dcedc6ef752b1e75be38d381b6310047c71d6e2ae1b97

                            SHA512

                            4feb227a295526b17cbb120b3d4698c4d0835b00aca669ce2d222a892fc129de9bc307387f8de1a4a7f98c29b11976edc814ad6f3e782e2d12c8aae165962e0b

                          • C:\Users\Admin\AppData\Local\Temp\C0C0.exe

                            Filesize

                            709KB

                            MD5

                            b4496d2224777403415440dfe5f13a86

                            SHA1

                            5c175589db78cce01a9730eb85e2898bdafe2a5a

                            SHA256

                            d3d8cacad2d64836340d846fe35f30eb06a02131ff64c2fb0fa8071065058548

                            SHA512

                            0bc9d8844df1fc09815b6226186f095dfe2630b0070999a840a07e458b104d03b2fbb969a56e6d62756fc11e7eecc9d25c3cc4a9a2b7d58ba1d9de1cc60d9158

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jokkrm4b.fiz.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                            Filesize

                            281KB

                            MD5

                            d98e33b66343e7c96158444127a117f6

                            SHA1

                            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                            SHA256

                            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                            SHA512

                            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                            Filesize

                            2KB

                            MD5

                            3d086a433708053f9bf9523e1d87a4e8

                            SHA1

                            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                            SHA256

                            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                            SHA512

                            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            e1d0675341bc0b795e031910b032138a

                            SHA1

                            f17b8eb408142161f058e16f1b4997e7ba2ed706

                            SHA256

                            fdf165e4ba4f45cf8bb6a3f9737fe00a7353ba9aa6f1048a5c3232f0031a074c

                            SHA512

                            60816e982a9162fb1649e3772d59089fcfaed5cb394d33892db9207d2d95d355dfa4c792654dfe9253bf15dad6a887abd4c8c5cfcef1f102fdb1d1fc733aad4b

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            4f670ee42cadd94bd6695c324be6ac4b

                            SHA1

                            e8c689da2d9181aeebfa83332a6cd453930537ab

                            SHA256

                            96af4ed93008c8e63c974fa0bad47b008c0c0585fe7c0c5b8f007cc69b3c334f

                            SHA512

                            20c181a66adaf7cbc35d4707007639e0cb283116f1103e6ffdc81efc9e00939a8ae006820dce82f046f150e2281fdbbd7034787eae6c3d9d3d40a4d818a4bf70

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            707526883a6475124f6a510cab013ba6

                            SHA1

                            bcce478b85ffdd73036d7a857901814eb728b730

                            SHA256

                            e07066d7af895e966076f605d4f5e517ad9d45b9b48eefd4905f4e7c7d5070e6

                            SHA512

                            b8c4403417ee9cf00efe3b649d4d44d7956942ac0aa602c0b48ca91d8f84f5427d2e38047d0d811cd100cb2db370523b3a6eb7e2e81cfad19a129a19835b34a4

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            01f288b841c906f73b555f812efa2d1e

                            SHA1

                            7438ba0ab2a3fe7b6fdf3e1a172d3d0eab09d537

                            SHA256

                            8b04fe91632a2f9526a95abdc482f14564bce88e23f7d7fae7f561ca990eec00

                            SHA512

                            014e287d88227cb16d661b95a839f7e0ae4a029865bb2ba2dbda7db49c2bc64da1524dbd3cf0619cfe9ed1f897b5fc4c33ed1796893843e90be963198ea5b6ea

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            9c918c5db14a0b4f79698289ad80ec73

                            SHA1

                            63e347661974491d72f37abd335b882fb3ca9006

                            SHA256

                            1239b504afae0a8881ac19ad328a74054c4cd2429610f03af9883b133f5fd2ef

                            SHA512

                            f7fe0fcaaef743000034dbc289b2452c98c98083feaa1e895947a2c56ded62adab988cf53cdc1fde78f527f51c8686995942781a9481c1936c12ff1d57a965d0

                          • C:\Windows\rss\csrss.exe

                            Filesize

                            704KB

                            MD5

                            3598076db97a10ec5dbf02282e499a12

                            SHA1

                            7dc81f6042b58e20c37e62b3c40e8f162426aae7

                            SHA256

                            5f66fd9993f986d609cb2d2a0c1483e9a963b1f8cd42d7137d90c3c3c3ad1299

                            SHA512

                            66b955e6a99b8e86a4d9735279506f963db0dd8fca28357e2d4e00ed7a64f980a0c10b1781e25105de8c39226ec4672337147803d00857de34139b0763512c13

                          • C:\Windows\rss\csrss.exe

                            Filesize

                            64KB

                            MD5

                            e31e017c97820e6188b934e0ec3063ab

                            SHA1

                            ae31efa705255a2e7212527de439c65b1629db82

                            SHA256

                            18acfc2b6a4518fffd7e44a4c73b8a1dee5a55cc0cf885b9ec79d7ea53239007

                            SHA512

                            8130999f465b3d13d4a6e188b1175bd931570d4395f87a815d97d6000f9574ae39580eb3803f4cc03730c4acdcede430acc3bea630f195fad45e7ecbbe001197

                          • C:\Windows\windefender.exe

                            Filesize

                            2.0MB

                            MD5

                            8e67f58837092385dcf01e8a2b4f5783

                            SHA1

                            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                            SHA256

                            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                            SHA512

                            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                          • memory/464-157-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/464-193-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/464-156-0x0000000004070000-0x000000000446C000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/464-258-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/500-22-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/500-21-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/500-20-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/500-34-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/500-18-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/552-5-0x0000000000400000-0x0000000001F00000-memory.dmp

                            Filesize

                            27.0MB

                          • memory/552-3-0x0000000000400000-0x0000000001F00000-memory.dmp

                            Filesize

                            27.0MB

                          • memory/552-2-0x0000000001F90000-0x0000000001F9B000-memory.dmp

                            Filesize

                            44KB

                          • memory/552-1-0x00000000020F0000-0x00000000021F0000-memory.dmp

                            Filesize

                            1024KB

                          • memory/832-195-0x00000000048F0000-0x0000000004900000-memory.dmp

                            Filesize

                            64KB

                          • memory/832-194-0x0000000074780000-0x0000000074F30000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/1172-162-0x0000000005490000-0x00000000054A0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1172-161-0x0000000005490000-0x00000000054A0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1172-160-0x0000000074780000-0x0000000074F30000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/1172-172-0x0000000070970000-0x00000000709BC000-memory.dmp

                            Filesize

                            304KB

                          • memory/1172-190-0x0000000074780000-0x0000000074F30000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/1172-187-0x0000000007E90000-0x0000000007EA4000-memory.dmp

                            Filesize

                            80KB

                          • memory/1172-186-0x0000000007E40000-0x0000000007E51000-memory.dmp

                            Filesize

                            68KB

                          • memory/1172-185-0x0000000005490000-0x00000000054A0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1172-184-0x0000000007B10000-0x0000000007BB3000-memory.dmp

                            Filesize

                            652KB

                          • memory/1172-174-0x0000000070AD0000-0x0000000070E24000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/1172-173-0x000000007F290000-0x000000007F2A0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1692-370-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/1692-316-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/2292-40-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/2292-43-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/2292-41-0x0000000000400000-0x0000000000537000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/2356-95-0x0000000003F70000-0x0000000004370000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/2356-158-0x0000000003F70000-0x0000000004370000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/2356-159-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/2356-97-0x0000000004370000-0x0000000004C5B000-memory.dmp

                            Filesize

                            8.9MB

                          • memory/2356-100-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/2356-126-0x0000000000400000-0x00000000022EF000-memory.dmp

                            Filesize

                            30.9MB

                          • memory/2920-313-0x00007FF77DC10000-0x00007FF77E872000-memory.dmp

                            Filesize

                            12.4MB

                          • memory/2920-192-0x00007FF77DC10000-0x00007FF77E872000-memory.dmp

                            Filesize

                            12.4MB

                          • memory/2920-369-0x00007FF77DC10000-0x00007FF77E872000-memory.dmp

                            Filesize

                            12.4MB

                          • memory/2920-260-0x00007FF77DC10000-0x00007FF77E872000-memory.dmp

                            Filesize

                            12.4MB

                          • memory/2920-155-0x00007FF77DC10000-0x00007FF77E872000-memory.dmp

                            Filesize

                            12.4MB

                          • memory/2928-67-0x0000000003410000-0x0000000003411000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-65-0x00000000033F0000-0x00000000033F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-54-0x0000000000F50000-0x0000000000F51000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-56-0x0000000000F60000-0x0000000001B53000-memory.dmp

                            Filesize

                            11.9MB

                          • memory/2928-55-0x0000000003370000-0x0000000003371000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-57-0x0000000003380000-0x0000000003381000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-58-0x0000000000F60000-0x0000000001B53000-memory.dmp

                            Filesize

                            11.9MB

                          • memory/2928-59-0x0000000003390000-0x0000000003391000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-60-0x00000000033A0000-0x00000000033A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-61-0x00000000033B0000-0x00000000033B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-62-0x00000000033C0000-0x00000000033C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-63-0x00000000033D0000-0x00000000033D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-64-0x00000000033E0000-0x00000000033E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-66-0x0000000003400000-0x0000000003401000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-68-0x0000000003430000-0x0000000003431000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-69-0x0000000003440000-0x0000000003441000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-70-0x0000000003450000-0x0000000003451000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-71-0x0000000003460000-0x0000000003461000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-72-0x0000000003470000-0x0000000003471000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-73-0x0000000003480000-0x0000000003481000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-74-0x0000000003490000-0x0000000003491000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-75-0x00000000034A0000-0x00000000034A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-76-0x00000000034B0000-0x00000000034B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-77-0x00000000034C0000-0x00000000034C1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-78-0x00000000034D0000-0x00000000034D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-79-0x00000000034E0000-0x00000000034E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-80-0x00000000034F0000-0x00000000034F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-81-0x0000000003500000-0x0000000003501000-memory.dmp

                            Filesize

                            4KB

                          • memory/2928-84-0x0000000003510000-0x0000000003542000-memory.dmp

                            Filesize

                            200KB

                          • memory/2928-85-0x0000000003510000-0x0000000003542000-memory.dmp

                            Filesize

                            200KB

                          • memory/2928-86-0x0000000003510000-0x0000000003542000-memory.dmp

                            Filesize

                            200KB

                          • memory/2928-101-0x0000000000F60000-0x0000000001B53000-memory.dmp

                            Filesize

                            11.9MB

                          • memory/2928-88-0x0000000003510000-0x0000000003542000-memory.dmp

                            Filesize

                            200KB

                          • memory/2928-87-0x0000000003510000-0x0000000003542000-memory.dmp

                            Filesize

                            200KB

                          • memory/3092-16-0x0000000003A90000-0x0000000003B2A000-memory.dmp

                            Filesize

                            616KB

                          • memory/3092-17-0x0000000003C60000-0x0000000003D7B000-memory.dmp

                            Filesize

                            1.1MB

                          • memory/3464-4-0x0000000003280000-0x0000000003296000-memory.dmp

                            Filesize

                            88KB

                          • memory/3488-380-0x0000000000400000-0x00000000008DF000-memory.dmp

                            Filesize

                            4.9MB

                          • memory/4020-37-0x0000000003BF0000-0x0000000003C8E000-memory.dmp

                            Filesize

                            632KB

                          • memory/4920-125-0x0000000007220000-0x000000000723A000-memory.dmp

                            Filesize

                            104KB

                          • memory/4920-122-0x00000000063B0000-0x00000000063F4000-memory.dmp

                            Filesize

                            272KB

                          • memory/4920-143-0x0000000007520000-0x000000000752A000-memory.dmp

                            Filesize

                            40KB

                          • memory/4920-142-0x0000000007430000-0x00000000074D3000-memory.dmp

                            Filesize

                            652KB

                          • memory/4920-140-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4920-141-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4920-139-0x0000000007410000-0x000000000742E000-memory.dmp

                            Filesize

                            120KB

                          • memory/4920-102-0x0000000002860000-0x0000000002896000-memory.dmp

                            Filesize

                            216KB

                          • memory/4920-129-0x0000000070AD0000-0x0000000070E24000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4920-128-0x0000000070970000-0x00000000709BC000-memory.dmp

                            Filesize

                            304KB

                          • memory/4920-127-0x00000000073D0000-0x0000000007402000-memory.dmp

                            Filesize

                            200KB

                          • memory/4920-152-0x0000000074780000-0x0000000074F30000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4920-124-0x0000000007880000-0x0000000007EFA000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/4920-104-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4920-123-0x0000000006F80000-0x0000000006FF6000-memory.dmp

                            Filesize

                            472KB

                          • memory/4920-144-0x00000000075E0000-0x0000000007676000-memory.dmp

                            Filesize

                            600KB

                          • memory/4920-121-0x0000000005E90000-0x0000000005EDC000-memory.dmp

                            Filesize

                            304KB

                          • memory/4920-120-0x0000000005E60000-0x0000000005E7E000-memory.dmp

                            Filesize

                            120KB

                          • memory/4920-119-0x00000000059A0000-0x0000000005CF4000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4920-109-0x0000000005830000-0x0000000005896000-memory.dmp

                            Filesize

                            408KB

                          • memory/4920-103-0x0000000074780000-0x0000000074F30000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4920-108-0x00000000057C0000-0x0000000005826000-memory.dmp

                            Filesize

                            408KB

                          • memory/4920-107-0x0000000004F20000-0x0000000004F42000-memory.dmp

                            Filesize

                            136KB

                          • memory/4920-105-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4920-106-0x0000000005120000-0x0000000005748000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/4920-145-0x0000000007540000-0x0000000007551000-memory.dmp

                            Filesize

                            68KB

                          • memory/4920-146-0x0000000007580000-0x000000000758E000-memory.dmp

                            Filesize

                            56KB

                          • memory/4920-147-0x0000000007590000-0x00000000075A4000-memory.dmp

                            Filesize

                            80KB

                          • memory/4920-148-0x0000000007680000-0x000000000769A000-memory.dmp

                            Filesize

                            104KB

                          • memory/4920-149-0x00000000075C0000-0x00000000075C8000-memory.dmp

                            Filesize

                            32KB