Malware Analysis Report

2025-08-10 17:22

Sample ID 240417-x3274ach8x
Target d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048
SHA256 d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048
Tags
glupteba dropper evasion loader upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048

Threat Level: Known bad

The file d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048 was found to be: Known bad.

Malicious Activity Summary

glupteba dropper evasion loader upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-17 19:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 19:23

Reported

2024-04-17 19:26

Platform

win10v2004-20240412-en

Max time kernel

1s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 60.166.213.23.in-addr.arpa udp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 168.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 1575df6c-91e3-48fc-8357-43500137c0ad.uuid.dumppage.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server2.dumppage.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.111:443 server2.dumppage.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 248.249.33.3.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
BG 185.82.216.111:443 server2.dumppage.org tcp
BG 185.82.216.111:443 server2.dumppage.org tcp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
BG 185.82.216.111:443 server2.dumppage.org tcp

Files

memory/220-1-0x0000000004DE0000-0x00000000051E1000-memory.dmp

memory/220-2-0x00000000051F0000-0x0000000005ADB000-memory.dmp

memory/220-3-0x0000000000400000-0x000000000310E000-memory.dmp

memory/4912-4-0x0000000004CF0000-0x0000000004D26000-memory.dmp

memory/4912-6-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/4912-8-0x00000000054B0000-0x0000000005AD8000-memory.dmp

memory/4912-7-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/4912-5-0x0000000074250000-0x0000000074A00000-memory.dmp

memory/4912-9-0x0000000005460000-0x0000000005482000-memory.dmp

memory/4912-11-0x0000000005CB0000-0x0000000005D16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqfddxoe.0da.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4912-10-0x0000000005B50000-0x0000000005BB6000-memory.dmp

memory/4912-21-0x0000000005E20000-0x0000000006174000-memory.dmp

memory/4912-22-0x0000000006320000-0x000000000633E000-memory.dmp

memory/4912-23-0x0000000006340000-0x000000000638C000-memory.dmp

memory/4912-24-0x0000000006880000-0x00000000068C4000-memory.dmp

memory/4912-25-0x0000000007690000-0x0000000007706000-memory.dmp

memory/4912-27-0x0000000007650000-0x000000000766A000-memory.dmp

memory/4912-26-0x0000000007D90000-0x000000000840A000-memory.dmp

memory/4912-30-0x00000000700F0000-0x000000007013C000-memory.dmp

memory/4912-41-0x00000000078D0000-0x00000000078EE000-memory.dmp

memory/4912-43-0x00000000078F0000-0x0000000007993000-memory.dmp

memory/4912-44-0x00000000079E0000-0x00000000079EA000-memory.dmp

memory/4912-42-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/4912-31-0x0000000070270000-0x00000000705C4000-memory.dmp

memory/4912-29-0x0000000007890000-0x00000000078C2000-memory.dmp

memory/4912-28-0x000000007EEB0000-0x000000007EEC0000-memory.dmp

memory/4912-45-0x0000000007AF0000-0x0000000007B86000-memory.dmp

memory/4912-46-0x00000000079F0000-0x0000000007A01000-memory.dmp

memory/4912-47-0x0000000007A30000-0x0000000007A3E000-memory.dmp

memory/4912-49-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

memory/4912-50-0x0000000007A90000-0x0000000007A98000-memory.dmp

memory/4912-48-0x0000000007A50000-0x0000000007A64000-memory.dmp

memory/4912-53-0x0000000074250000-0x0000000074A00000-memory.dmp

memory/2460-55-0x0000000004D30000-0x000000000512B000-memory.dmp

memory/220-56-0x0000000004DE0000-0x00000000051E1000-memory.dmp

memory/2460-57-0x0000000000400000-0x000000000310E000-memory.dmp

memory/4588-69-0x0000000002750000-0x0000000002760000-memory.dmp

memory/4588-70-0x0000000074250000-0x0000000074A00000-memory.dmp

memory/4588-68-0x0000000002750000-0x0000000002760000-memory.dmp

memory/220-67-0x00000000051F0000-0x0000000005ADB000-memory.dmp

memory/220-71-0x0000000000400000-0x000000000310E000-memory.dmp

memory/4588-73-0x00000000700F0000-0x000000007013C000-memory.dmp

memory/4588-74-0x0000000070270000-0x00000000705C4000-memory.dmp

memory/4588-85-0x0000000006FB0000-0x0000000007053000-memory.dmp

memory/4588-84-0x0000000002750000-0x0000000002760000-memory.dmp

memory/4588-72-0x000000007FD20000-0x000000007FD30000-memory.dmp

memory/4588-86-0x00000000072B0000-0x00000000072C1000-memory.dmp

memory/4588-87-0x0000000007300000-0x0000000007314000-memory.dmp

memory/4588-90-0x0000000074250000-0x0000000074A00000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4632-94-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/4632-93-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/4632-92-0x0000000074250000-0x0000000074A00000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 abb77b59938118eb6223eb283846c834
SHA1 a1dd67f8256ed995e39a5ad45d27e92b90f8c54d
SHA256 1a72bb1e516166b0832d7c2b6b0db93063c4e8d8a71e47377dec9513bfefdbd3
SHA512 2ffc9e0fcd4afc6e07da478423ae82b718806bb4a401597ad96418d862da40c98ee3d548b85c303dfc6006ad1556b7c873fa711202c8a7fc8ab8a29c63fcd504

memory/4632-106-0x00000000700F0000-0x000000007013C000-memory.dmp

memory/4632-117-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/4632-107-0x0000000070270000-0x00000000705C4000-memory.dmp

memory/4632-105-0x000000007F9C0000-0x000000007F9D0000-memory.dmp

memory/4632-119-0x0000000074250000-0x0000000074A00000-memory.dmp

memory/2408-133-0x0000000003170000-0x0000000003180000-memory.dmp

memory/2408-135-0x0000000003170000-0x0000000003180000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4cabb8c9dffd4af4e9cef3cb4ae714b5
SHA1 4d9f76bbe4bf7069b790139d8115b99932edd95f
SHA256 c09ed21cfc64ea73e77f8e6a30cd3f5f144ae77844be08ff21e258c764441622
SHA512 3838505de1439e9213a8934f6a0bb6f6b3e94381ef406d23d058966c68b4c90fa4f53e247d80dca9083bea1063dda9b7f5db5edeed200af8f845414219259352

memory/2460-132-0x0000000004D30000-0x000000000512B000-memory.dmp

memory/2408-131-0x0000000074250000-0x0000000074A00000-memory.dmp

memory/2408-130-0x00000000061F0000-0x0000000006544000-memory.dmp

memory/2408-136-0x00000000700F0000-0x000000007013C000-memory.dmp

memory/2408-137-0x00000000708A0000-0x0000000070BF4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 a5b310be46085d15ecb18f1b8df7d028
SHA1 8546ef9d9204363ad9183869d4569a2f46df91c1
SHA256 d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048
SHA512 024b18608765a167e362a694186da8e0bd33f3c5517342f6bb4ee77120c93f24376ed7ed8f48f5f3c0975b70693f40ad822d40640787c52317aa4620422915a4

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 64f7a89121ac2cea0513783a0bc8ee58
SHA1 acf0967ec2c12050fdc3f72f553aab9a3128fafb
SHA256 bd52fae5fd69ee4699fb60b8f724629bad21534e97039919479278f366aad836
SHA512 a29f60f783b5153ce0ea2673cfe1fe6475bca6bb7b5ca07bb45792805f3fb8df26b338313049fd1be2c850cbe73cea37474e1b4a4270511a5e615f727000aa9b

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9f23145d7f7f8205d20dffd739eb3084
SHA1 5784247da7628322d742d936f8f9dd9227f407a8
SHA256 49bfde33c6ee68c9cd1cb6305df3961ebbac1e26fd345b128a01f48ae495c3e4
SHA512 aff3c1baa8dcf826c8424cb52c426b0753ba32f95560d7c8e7c0120b216cab30f9c1f5470ebd4ec592068bbd1b7afe3d40cdc07b00e92649a67bc9baa63bda80

memory/2460-202-0x0000000000400000-0x000000000310E000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 725b2fca0c72ebdd2185ab2f8a05c48c
SHA1 675656c55bd8fb43ef658a5b4d07211967aeddb4
SHA256 d844708a8bbab0ccaa26e8b85b475ffa378ccee956ff105568119008b71726c9
SHA512 0cbba483cb811017822ed41f73978c37791e345d7ec37b0b6f3faba6b1f2670b2a86daf0fcc7536244861b3a3712a13e34c0ba169420af3bcfcc4442f72df624

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1876-257-0x0000000000400000-0x000000000310E000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1796-265-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1876-268-0x0000000000400000-0x000000000310E000-memory.dmp

memory/4912-270-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1876-272-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-276-0x0000000000400000-0x000000000310E000-memory.dmp

memory/4912-278-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1876-280-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-284-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-288-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-292-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-296-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-300-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-304-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-308-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1876-312-0x0000000000400000-0x000000000310E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 19:23

Reported

2024-04-17 19:26

Platform

win11-20240412-en

Max time kernel

8s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\system32\cmd.exe
PID 2928 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\system32\cmd.exe
PID 1500 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1500 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2928 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe

"C:\Users\Admin\AppData\Local\Temp\d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 6dad8d1a-9dfe-473d-b251-db4ad6938817.uuid.dumppage.org udp
US 8.8.8.8:53 server12.dumppage.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server12.dumppage.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.111:443 server12.dumppage.org tcp
US 52.111.227.13:443 tcp
BG 185.82.216.111:443 server12.dumppage.org tcp
BG 185.82.216.111:443 server12.dumppage.org tcp

Files

memory/2820-1-0x0000000004F60000-0x0000000005367000-memory.dmp

memory/2820-2-0x0000000005370000-0x0000000005C5B000-memory.dmp

memory/2820-3-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1448-4-0x0000000002700000-0x0000000002736000-memory.dmp

memory/1448-6-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/1448-7-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/1448-5-0x0000000074150000-0x0000000074901000-memory.dmp

memory/1448-8-0x0000000005030000-0x000000000565A000-memory.dmp

memory/1448-9-0x0000000004DF0000-0x0000000004E12000-memory.dmp

memory/1448-10-0x0000000004E90000-0x0000000004EF6000-memory.dmp

memory/1448-11-0x0000000004F70000-0x0000000004FD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdouomfd.0qz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1448-20-0x00000000057A0000-0x0000000005AF7000-memory.dmp

memory/1448-21-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

memory/1448-22-0x0000000005C00000-0x0000000005C4C000-memory.dmp

memory/1448-23-0x0000000006120000-0x0000000006166000-memory.dmp

memory/1448-26-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/1448-38-0x00000000049F0000-0x0000000004A00000-memory.dmp

memory/1448-37-0x0000000007040000-0x00000000070E4000-memory.dmp

memory/1448-36-0x0000000007020000-0x000000000703E000-memory.dmp

memory/1448-40-0x0000000007170000-0x000000000718A000-memory.dmp

memory/1448-41-0x00000000071B0000-0x00000000071BA000-memory.dmp

memory/1448-42-0x00000000072C0000-0x0000000007356000-memory.dmp

memory/1448-43-0x00000000071D0000-0x00000000071E1000-memory.dmp

memory/1448-39-0x00000000077B0000-0x0000000007E2A000-memory.dmp

memory/1448-27-0x0000000070540000-0x0000000070897000-memory.dmp

memory/1448-25-0x000000007FB70000-0x000000007FB80000-memory.dmp

memory/1448-24-0x0000000006FE0000-0x0000000007014000-memory.dmp

memory/1448-44-0x0000000007220000-0x000000000722E000-memory.dmp

memory/1448-45-0x0000000007230000-0x0000000007245000-memory.dmp

memory/1448-46-0x0000000007280000-0x000000000729A000-memory.dmp

memory/1448-47-0x00000000072A0000-0x00000000072A8000-memory.dmp

memory/1448-50-0x0000000074150000-0x0000000074901000-memory.dmp

memory/2928-52-0x0000000004E30000-0x0000000005230000-memory.dmp

memory/2820-53-0x0000000004F60000-0x0000000005367000-memory.dmp

memory/2928-63-0x0000000000400000-0x000000000310E000-memory.dmp

memory/2516-62-0x0000000005710000-0x0000000005A67000-memory.dmp

memory/2516-65-0x0000000004A30000-0x0000000004A40000-memory.dmp

memory/2516-64-0x0000000004A30000-0x0000000004A40000-memory.dmp

memory/2820-66-0x0000000005370000-0x0000000005C5B000-memory.dmp

memory/2516-67-0x0000000074150000-0x0000000074901000-memory.dmp

memory/2516-70-0x0000000070D90000-0x00000000710E7000-memory.dmp

memory/2516-79-0x0000000007070000-0x0000000007114000-memory.dmp

memory/2516-69-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/2516-68-0x000000007F3C0000-0x000000007F3D0000-memory.dmp

memory/2820-80-0x0000000000400000-0x000000000310E000-memory.dmp

memory/2516-82-0x0000000004A30000-0x0000000004A40000-memory.dmp

memory/2516-81-0x0000000004A30000-0x0000000004A40000-memory.dmp

memory/2516-83-0x00000000073B0000-0x00000000073C1000-memory.dmp

memory/2516-84-0x0000000007400000-0x0000000007415000-memory.dmp

memory/2516-87-0x0000000074150000-0x0000000074901000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4028-91-0x0000000004690000-0x00000000046A0000-memory.dmp

memory/4028-90-0x0000000004690000-0x00000000046A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 992ca2a641c1b7f6464ee0f21f29dd22
SHA1 c2d19f75ac03e72902e9204e42aa2e62794d0c1e
SHA256 40ec4413d877a6a334af91940166ef827dcd8a9a09b8f2374eaf8547c05c95c2
SHA512 14a2c3d45bf9485989b0fba0b6a85bab3b08f5ac16d58133fe91250f0ec044579f563a84f9586924d56a5d0a38a9cb3eb5c2349bd77813e5b0543ef5a0da07e8

memory/4028-89-0x0000000074150000-0x0000000074901000-memory.dmp

memory/4028-103-0x0000000070540000-0x0000000070897000-memory.dmp

memory/4028-113-0x0000000004690000-0x00000000046A0000-memory.dmp

memory/4028-112-0x0000000004690000-0x00000000046A0000-memory.dmp

memory/4028-102-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/4028-101-0x000000007FC70000-0x000000007FC80000-memory.dmp

memory/4988-116-0x0000000074150000-0x0000000074901000-memory.dmp

memory/4988-118-0x0000000004C70000-0x0000000004C80000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 abab6ee2ae69634eaa641f26380b8601
SHA1 6e99e5975ef585d83ca51ae881fc50eb0fc82f09
SHA256 148594c9d84732a7f62f5406612bae1bb1ad917aef278aa83c4e73c26a660e1a
SHA512 e5c43680c46de90b5ab1516867bf1559730a86b9496c426ae062c67c213ea0da0c7b4a27c174203de2a22266aecfd135a919d62eb3b100d11e40925accc61d66

memory/2928-117-0x0000000004E30000-0x0000000005230000-memory.dmp

memory/4028-115-0x0000000074150000-0x0000000074901000-memory.dmp

memory/4988-129-0x0000000070540000-0x0000000070897000-memory.dmp

memory/4988-128-0x00000000703C0000-0x000000007040C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 a5b310be46085d15ecb18f1b8df7d028
SHA1 8546ef9d9204363ad9183869d4569a2f46df91c1
SHA256 d9e974768ed6a1bed58ee8c29133b4fea7f98e9818be6a6dc0a997f25a0e2048
SHA512 024b18608765a167e362a694186da8e0bd33f3c5517342f6bb4ee77120c93f24376ed7ed8f48f5f3c0975b70693f40ad822d40640787c52317aa4620422915a4

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 37a5c5c3033b690ac9dab3485eed4991
SHA1 5cde3de819df729e0a1ee58e1028b2111aab84d1
SHA256 5772da181623e25f49dd9ae72f638c354b843de05e8f0c03aec867759cd8dea4
SHA512 e3dd49ce7d24751784f1db3c48489611610e09eb096d30d96d4750e164878e0c21af3dcf6841763f463a4608e394405022f333f8c835aa059e7669ef50ddb217

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 62ce9b1669ff5d0eb1489de4cf2dfe03
SHA1 3e96c85343c6a06f7f2bf698192814531af1f548
SHA256 f93b7806b58a59a97318bb84ef6bb0f90c5febbf62c04355e6aeda34795a92f0
SHA512 ace475bef9db02925f131d0f00558df0e4836d2369ce9e6f6202466277b1e0834de76fd81288c45fa6a198131af5a3c00adb7c623a758c89d6091d8d9e4ffd94

memory/2928-206-0x0000000000400000-0x000000000310E000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1ec6e9120f7125f8f93445be3c504c31
SHA1 378eea5826829087f299eed4951885bb28375585
SHA256 4bbe3fce0364777cec0173f580c002f48e6776059e30c0d9f4f8c45912b4511c
SHA512 b50583916da7ab36a02e3d474f29f04129fb5d8c1ab48e394e581486ac2d6e8d415a59c407fd200696692ba07b0aac58d74de0b44cb2de6ef3be43bfbb052d18

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3076-241-0x0000000000400000-0x000000000310E000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1916-249-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3076-252-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1464-254-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3076-256-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-260-0x0000000000400000-0x000000000310E000-memory.dmp

memory/1464-262-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3076-264-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-268-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-272-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-276-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-280-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-284-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-288-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-292-0x0000000000400000-0x000000000310E000-memory.dmp

memory/3076-296-0x0000000000400000-0x000000000310E000-memory.dmp