Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 02:13

General

  • Target

    336454ac34e8f8e0a87e35d3e140b5507a59fd100211f19c9f52829fb94ebe69.exe

  • Size

    161KB

  • MD5

    26372b0b4b307a2d1b7ed4e6039ba23e

  • SHA1

    423a2290db7b757245efc42327ac9667c0bd91c6

  • SHA256

    336454ac34e8f8e0a87e35d3e140b5507a59fd100211f19c9f52829fb94ebe69

  • SHA512

    c0e868d9cfa9c843c12790a3e7a442117952039ebc6c1852b51c6f490d7429d6950fab1666f7d24d69ec90aad4420fa3c3575a12952e4bfdc116e1cd48356ad3

  • SSDEEP

    1536:YY55gZdDecFo+b3K//ErpPriC8YEJfIHooSi6B35R5W3ScYCcojrECIMckz+rug:hiZUCzKhJfIHBs35npcYCcsECIMckz+

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 11 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Detects Windows executables referencing non-Windows User-Agents 10 IoCs
  • Detects executables Discord URL observed in first stage droppers 10 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 10 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 10 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 10 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\336454ac34e8f8e0a87e35d3e140b5507a59fd100211f19c9f52829fb94ebe69.exe
    "C:\Users\Admin\AppData\Local\Temp\336454ac34e8f8e0a87e35d3e140b5507a59fd100211f19c9f52829fb94ebe69.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3628
  • C:\Users\Admin\AppData\Local\Temp\AE60.exe
    C:\Users\Admin\AppData\Local\Temp\AE60.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\AE60.exe
      C:\Users\Admin\AppData\Local\Temp\AE60.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\6d8992a8-b344-4c75-9787-37dd025ff4c3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3984
      • C:\Users\Admin\AppData\Local\Temp\AE60.exe
        "C:\Users\Admin\AppData\Local\Temp\AE60.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Users\Admin\AppData\Local\Temp\AE60.exe
          "C:\Users\Admin\AppData\Local\Temp\AE60.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:3476
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 568
            5⤵
            • Program crash
            PID:4512
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3476 -ip 3476
    1⤵
      PID:4324
    • C:\Users\Admin\AppData\Local\Temp\FDD9.exe
      C:\Users\Admin\AppData\Local\Temp\FDD9.exe
      1⤵
      • Executes dropped EXE
      PID:4820
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\174.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:3152
      • C:\Users\Admin\AppData\Local\Temp\BA6.exe
        C:\Users\Admin\AppData\Local\Temp\BA6.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3516
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 2496
            3⤵
            • Program crash
            PID:4072
        • C:\Users\Admin\AppData\Local\Temp\BA6.exe
          "C:\Users\Admin\AppData\Local\Temp\BA6.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:8
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1236
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:224
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:3984
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4816
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:3904
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:4808
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              4⤵
                PID:1948
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4472
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:1156
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                4⤵
                • Executes dropped EXE
                PID:1960
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:4476
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                4⤵
                • Executes dropped EXE
                PID:3564
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  5⤵
                    PID:4416
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      6⤵
                      • Launches sc.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2076
          • C:\Users\Admin\AppData\Local\Temp\1BD4.exe
            C:\Users\Admin\AppData\Local\Temp\1BD4.exe
            1⤵
            • Executes dropped EXE
            PID:3396
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3516 -ip 3516
            1⤵
              PID:4180
            • C:\Windows\windefender.exe
              C:\Windows\windefender.exe
              1⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              PID:2500

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\174.bat

              Filesize

              77B

              MD5

              55cc761bf3429324e5a0095cab002113

              SHA1

              2cc1ef4542a4e92d4158ab3978425d517fafd16d

              SHA256

              d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

              SHA512

              33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

            • C:\Users\Admin\AppData\Local\Temp\1BD4.exe

              Filesize

              4.6MB

              MD5

              0081df746d75e350b73b1657e6fba9a8

              SHA1

              8ccb0eb4d6e68dfee2e1025faba62676a036d3b6

              SHA256

              f40e93c8dffce686a76677574afa472fa1083088d43e1c9e022d64abad0f4146

              SHA512

              26d6f35778e41fe6ff14d426af45b26b452a683f9a1737bdae21c05262dfb65618169b34275f9df69b68d6c41a87b6d259406e11feb1ab11e2b0f916b9958ca0

            • C:\Users\Admin\AppData\Local\Temp\1BD4.exe

              Filesize

              2.6MB

              MD5

              c7ef32eedfb940964ab274fe65ef863f

              SHA1

              23032f5869cadc3711b9a7089aaec15d2727ff33

              SHA256

              fae7d1e4f7ac2797d2b2e4bdd814236bcdb1f6e7b58d7ec027e5fd9d8043579d

              SHA512

              eb7ebd37fcb51dd4dbb243cfc86993d65ba28ff6d5548a6728329a51245610c561810e5f2e9f0c8031ea8c75a200f65e2b5d4634889433afbb0717da692fcddd

            • C:\Users\Admin\AppData\Local\Temp\AE60.exe

              Filesize

              709KB

              MD5

              b4496d2224777403415440dfe5f13a86

              SHA1

              5c175589db78cce01a9730eb85e2898bdafe2a5a

              SHA256

              d3d8cacad2d64836340d846fe35f30eb06a02131ff64c2fb0fa8071065058548

              SHA512

              0bc9d8844df1fc09815b6226186f095dfe2630b0070999a840a07e458b104d03b2fbb969a56e6d62756fc11e7eecc9d25c3cc4a9a2b7d58ba1d9de1cc60d9158

            • C:\Users\Admin\AppData\Local\Temp\BA6.exe

              Filesize

              4.1MB

              MD5

              1047d7617f162d488920965b0a8b876c

              SHA1

              059afd73ca2f9b7c358979a6f1cc99c5424281a2

              SHA256

              58b5bdc3cd4730734032dcc2dde7452889e6b6a12f3ae61e142df1121551859c

              SHA512

              698483dca1f3dc3a3056b041a7c70e1609d86dcc4dc9751b04a67810be19c999235372d1a07d5806459f51d513deab91524c6fccd83b554afc331914690b74ac

            • C:\Users\Admin\AppData\Local\Temp\FDD9.exe

              Filesize

              6.7MB

              MD5

              74cf066c5c492eb825b36550b1e38326

              SHA1

              8f211213fbd6905b5e44bf2af07e481832198a7f

              SHA256

              24201da166b3e59a7a2b79f24881222c41e35f26642dd757fcc51ec47c9404e4

              SHA512

              24ad3ebb70332741959b13be504ec2b3baee9668bb3a8e8ae314432ac2e084ad11c03f4abfba6f7557273cddb1b3d2e2361c71246f3fd7fccabae218dd8b2e91

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xitrddyo.mkx.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

              Filesize

              281KB

              MD5

              d98e33b66343e7c96158444127a117f6

              SHA1

              bb716c5509a2bf345c6c1152f6e3e1452d39d50d

              SHA256

              5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

              SHA512

              705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              968cb9309758126772781b83adb8a28f

              SHA1

              8da30e71accf186b2ba11da1797cf67f8f78b47c

              SHA256

              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

              SHA512

              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              91a3f972254aa432cc7e8ed2a3fb9f5f

              SHA1

              225177f510fc2e81e587020d00f2cfb2732f5315

              SHA256

              d61ac12cd944b0f17b19f6a16002c6cca960c28accce44ecb03d124cdd86631f

              SHA512

              7ea14a012efab3d26f4fa4a49303e06313f694f33506324da8c13b8b66ff46800c4889e9acfd3688441ec930968d7bf3f42c714bed7c98eee1820b06ad9531af

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              7ffd92edc796dfe039ddc0fcc9198fee

              SHA1

              0f29f5aec17d91d6971c6ef8a00fd85e568bf374

              SHA256

              dc1ad90e8c1f4df414728e49877d89edc59c7db3c9ee86791c447d612ab9b3b7

              SHA512

              dc9aed3b0fc37d40bcf6d131f0622d515e518bf3e6aee2cee48cfcf04deebf32af8ad8f5390a26178defd1b86d58b61ee737997053aae369c4ba27ec030d5aa2

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              48f6b6571e047927fa861b119b168571

              SHA1

              cf8147ca8f2860be7a13f88bffb1734911fcfff7

              SHA256

              a21e09f2b6a36f51e9704bad8d85826e257a0a5caf1f56ccf513dfad1391943e

              SHA512

              ba362880c6ff6f68ec275f03729448d42c20b4d0c46521b44d6c429a05246efe9729f5d271d3cf359bb135b6dd2a1a35c9c320c90b657a402933e657d0771f2f

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              598e3c2206a47302d53ed4dd572a52b6

              SHA1

              865d32124075db660e480e0e415dfd8afb804346

              SHA256

              fb4e75453d80cab3accdcca0189c31c10eedc364ec44dfeddc97ebfd34258f4f

              SHA512

              fd911e297def311c7eb756cf97bc2f3bcac0099039f01dbe4ed4cc1d2ce4db35f705fdbcea7509bc729562e50a4a2a969772d8fbe5cdb3f0f30e96208bbc644d

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              91cd7911a4f06d3a85122f3619fa1f6e

              SHA1

              ced2107ecb80fac8faa3c1261b1e7ea1203967e1

              SHA256

              1ea0f323ab85d39ec98cc3478dd76079967ea6e3efdc387ba45b239f1c735d79

              SHA512

              6cf55fcbe0c47148499d179ff7facc8417a00add6f3ea17bb6c57cb1afe1e3efd2e29a3c8fece6afa5939cb48b61d2897ec13e17d04be941b84c38e5e7056128

            • C:\Windows\rss\csrss.exe

              Filesize

              896KB

              MD5

              e2fa77d881933ea644c3edd1c96d70d5

              SHA1

              b1853d17f7559c44f9d3f678918352422ff17915

              SHA256

              220855025402eab41b35b82fdcd0cd8b97d7a1b1153255f4319286c3ab4cb532

              SHA512

              4979b6ef65545b81dd90b702781020dda0064c709246bc368587bd92ac36eeeff87d7987cc2278951764af6c812e2d8e60f6dc40b8a3fa7ba06fd7bcc03aaf74

            • C:\Windows\windefender.exe

              Filesize

              2.0MB

              MD5

              8e67f58837092385dcf01e8a2b4f5783

              SHA1

              012c49cfd8c5d06795a6f67ea2baf2a082cf8625

              SHA256

              166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

              SHA512

              40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

            • memory/8-174-0x0000000004E80000-0x0000000004E90000-memory.dmp

              Filesize

              64KB

            • memory/8-176-0x00000000079D0000-0x0000000007A66000-memory.dmp

              Filesize

              600KB

            • memory/8-163-0x00000000716C0000-0x0000000071A14000-memory.dmp

              Filesize

              3.3MB

            • memory/8-179-0x0000000007940000-0x0000000007954000-memory.dmp

              Filesize

              80KB

            • memory/8-164-0x000000007F800000-0x000000007F810000-memory.dmp

              Filesize

              64KB

            • memory/8-150-0x0000000005D70000-0x00000000060C4000-memory.dmp

              Filesize

              3.3MB

            • memory/8-162-0x0000000070F20000-0x0000000070F6C000-memory.dmp

              Filesize

              304KB

            • memory/8-181-0x0000000007970000-0x0000000007978000-memory.dmp

              Filesize

              32KB

            • memory/8-175-0x00000000075E0000-0x0000000007683000-memory.dmp

              Filesize

              652KB

            • memory/8-149-0x0000000004E80000-0x0000000004E90000-memory.dmp

              Filesize

              64KB

            • memory/8-178-0x0000000007930000-0x000000000793E000-memory.dmp

              Filesize

              56KB

            • memory/8-180-0x0000000007980000-0x000000000799A000-memory.dmp

              Filesize

              104KB

            • memory/8-177-0x00000000078F0000-0x0000000007901000-memory.dmp

              Filesize

              68KB

            • memory/8-184-0x0000000075020000-0x00000000757D0000-memory.dmp

              Filesize

              7.7MB

            • memory/8-148-0x0000000004E80000-0x0000000004E90000-memory.dmp

              Filesize

              64KB

            • memory/8-147-0x0000000075020000-0x00000000757D0000-memory.dmp

              Filesize

              7.7MB

            • memory/8-160-0x00000000064C0000-0x000000000650C000-memory.dmp

              Filesize

              304KB

            • memory/1612-369-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/1612-317-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/1612-363-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/1612-353-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/1612-366-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/2160-16-0x0000000002210000-0x00000000022A4000-memory.dmp

              Filesize

              592KB

            • memory/2160-17-0x0000000003C90000-0x0000000003DAB000-memory.dmp

              Filesize

              1.1MB

            • memory/2412-247-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/2412-200-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/2412-145-0x0000000004040000-0x0000000004446000-memory.dmp

              Filesize

              4.0MB

            • memory/2412-146-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/2500-370-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

            • memory/2500-364-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

            • memory/3396-362-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-161-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-365-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-368-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-352-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-316-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-250-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3396-371-0x00007FF7640A0000-0x00007FF764D02000-memory.dmp

              Filesize

              12.4MB

            • memory/3416-4-0x00000000032F0000-0x0000000003306000-memory.dmp

              Filesize

              88KB

            • memory/3476-41-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/3476-40-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/3476-43-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/3516-107-0x0000000005B20000-0x0000000005B86000-memory.dmp

              Filesize

              408KB

            • memory/3516-139-0x00000000077E0000-0x0000000007883000-memory.dmp

              Filesize

              652KB

            • memory/3516-104-0x0000000005300000-0x0000000005928000-memory.dmp

              Filesize

              6.2MB

            • memory/3516-103-0x0000000002C20000-0x0000000002C30000-memory.dmp

              Filesize

              64KB

            • memory/3516-105-0x0000000002C20000-0x0000000002C30000-memory.dmp

              Filesize

              64KB

            • memory/3516-106-0x0000000005240000-0x0000000005262000-memory.dmp

              Filesize

              136KB

            • memory/3516-101-0x0000000002C30000-0x0000000002C66000-memory.dmp

              Filesize

              216KB

            • memory/3516-117-0x0000000005D00000-0x0000000005D66000-memory.dmp

              Filesize

              408KB

            • memory/3516-102-0x0000000074F80000-0x0000000075730000-memory.dmp

              Filesize

              7.7MB

            • memory/3516-118-0x0000000005D70000-0x00000000060C4000-memory.dmp

              Filesize

              3.3MB

            • memory/3516-119-0x00000000061F0000-0x000000000620E000-memory.dmp

              Filesize

              120KB

            • memory/3516-120-0x0000000006230000-0x000000000627C000-memory.dmp

              Filesize

              304KB

            • memory/3516-121-0x0000000006750000-0x0000000006794000-memory.dmp

              Filesize

              272KB

            • memory/3516-122-0x0000000007530000-0x00000000075A6000-memory.dmp

              Filesize

              472KB

            • memory/3516-123-0x0000000007C30000-0x00000000082AA000-memory.dmp

              Filesize

              6.5MB

            • memory/3516-124-0x00000000075D0000-0x00000000075EA000-memory.dmp

              Filesize

              104KB

            • memory/3516-125-0x0000000007780000-0x00000000077B2000-memory.dmp

              Filesize

              200KB

            • memory/3516-127-0x0000000070E20000-0x0000000070E6C000-memory.dmp

              Filesize

              304KB

            • memory/3516-126-0x000000007F840000-0x000000007F850000-memory.dmp

              Filesize

              64KB

            • memory/3516-128-0x0000000070FA0000-0x00000000712F4000-memory.dmp

              Filesize

              3.3MB

            • memory/3516-138-0x00000000077C0000-0x00000000077DE000-memory.dmp

              Filesize

              120KB

            • memory/3516-141-0x0000000074F80000-0x0000000075730000-memory.dmp

              Filesize

              7.7MB

            • memory/3516-140-0x00000000078D0000-0x00000000078DA000-memory.dmp

              Filesize

              40KB

            • memory/3564-361-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

            • memory/3628-2-0x0000000003B00000-0x0000000003B0B000-memory.dmp

              Filesize

              44KB

            • memory/3628-1-0x0000000002150000-0x0000000002250000-memory.dmp

              Filesize

              1024KB

            • memory/3628-5-0x0000000000400000-0x0000000001F00000-memory.dmp

              Filesize

              27.0MB

            • memory/3628-3-0x0000000000400000-0x0000000001F00000-memory.dmp

              Filesize

              27.0MB

            • memory/3764-95-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/3764-94-0x0000000003F20000-0x000000000431C000-memory.dmp

              Filesize

              4.0MB

            • memory/3764-142-0x0000000000400000-0x00000000022EF000-memory.dmp

              Filesize

              30.9MB

            • memory/3764-96-0x0000000004320000-0x0000000004C0B000-memory.dmp

              Filesize

              8.9MB

            • memory/3984-188-0x00000000049C0000-0x00000000049D0000-memory.dmp

              Filesize

              64KB

            • memory/3984-186-0x0000000075020000-0x00000000757D0000-memory.dmp

              Filesize

              7.7MB

            • memory/3984-201-0x00000000716C0000-0x0000000071A14000-memory.dmp

              Filesize

              3.3MB

            • memory/3984-199-0x0000000070F20000-0x0000000070F6C000-memory.dmp

              Filesize

              304KB

            • memory/3984-187-0x00000000049C0000-0x00000000049D0000-memory.dmp

              Filesize

              64KB

            • memory/4072-37-0x0000000003BB0000-0x0000000003C44000-memory.dmp

              Filesize

              592KB

            • memory/4704-34-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/4704-18-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/4704-22-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/4704-20-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/4704-21-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/4820-77-0x0000000003A80000-0x0000000003A81000-memory.dmp

              Filesize

              4KB

            • memory/4820-70-0x0000000003900000-0x0000000003901000-memory.dmp

              Filesize

              4KB

            • memory/4820-69-0x00000000038F0000-0x00000000038F1000-memory.dmp

              Filesize

              4KB

            • memory/4820-71-0x0000000003910000-0x0000000003911000-memory.dmp

              Filesize

              4KB

            • memory/4820-72-0x0000000003920000-0x0000000003921000-memory.dmp

              Filesize

              4KB

            • memory/4820-73-0x0000000003930000-0x0000000003931000-memory.dmp

              Filesize

              4KB

            • memory/4820-68-0x00000000038E0000-0x00000000038E1000-memory.dmp

              Filesize

              4KB

            • memory/4820-74-0x0000000003940000-0x0000000003941000-memory.dmp

              Filesize

              4KB

            • memory/4820-75-0x0000000003A60000-0x0000000003A61000-memory.dmp

              Filesize

              4KB

            • memory/4820-67-0x00000000038D0000-0x00000000038D1000-memory.dmp

              Filesize

              4KB

            • memory/4820-66-0x00000000038C0000-0x00000000038C1000-memory.dmp

              Filesize

              4KB

            • memory/4820-65-0x00000000038B0000-0x00000000038B1000-memory.dmp

              Filesize

              4KB

            • memory/4820-63-0x00000000038A0000-0x00000000038A1000-memory.dmp

              Filesize

              4KB

            • memory/4820-62-0x0000000003890000-0x0000000003891000-memory.dmp

              Filesize

              4KB

            • memory/4820-61-0x0000000003880000-0x0000000003881000-memory.dmp

              Filesize

              4KB

            • memory/4820-60-0x0000000003870000-0x0000000003871000-memory.dmp

              Filesize

              4KB

            • memory/4820-59-0x0000000003860000-0x0000000003861000-memory.dmp

              Filesize

              4KB

            • memory/4820-58-0x0000000000C10000-0x0000000001803000-memory.dmp

              Filesize

              11.9MB

            • memory/4820-57-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

              Filesize

              4KB

            • memory/4820-55-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

              Filesize

              4KB

            • memory/4820-56-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

              Filesize

              4KB

            • memory/4820-54-0x0000000000C10000-0x0000000001803000-memory.dmp

              Filesize

              11.9MB

            • memory/4820-53-0x0000000001C60000-0x0000000001C61000-memory.dmp

              Filesize

              4KB

            • memory/4820-76-0x0000000003A70000-0x0000000003A71000-memory.dmp

              Filesize

              4KB

            • memory/4820-78-0x0000000003A90000-0x0000000003A91000-memory.dmp

              Filesize

              4KB

            • memory/4820-79-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

              Filesize

              4KB

            • memory/4820-80-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

              Filesize

              4KB

            • memory/4820-81-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

              Filesize

              4KB

            • memory/4820-84-0x0000000003AD0000-0x0000000003B02000-memory.dmp

              Filesize

              200KB

            • memory/4820-85-0x0000000003AD0000-0x0000000003B02000-memory.dmp

              Filesize

              200KB

            • memory/4820-86-0x0000000003AD0000-0x0000000003B02000-memory.dmp

              Filesize

              200KB

            • memory/4820-87-0x0000000003AD0000-0x0000000003B02000-memory.dmp

              Filesize

              200KB

            • memory/4820-92-0x0000000000C10000-0x0000000001803000-memory.dmp

              Filesize

              11.9MB