Analysis
-
max time kernel
314s -
max time network
325s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe
Resource
win7-20240220-en
General
-
Target
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe
-
Size
4.2MB
-
MD5
1af71dd16e660e3feb1290f8563b7cae
-
SHA1
4816758a46639e32535635ee5c77dac74ffdffc8
-
SHA256
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b
-
SHA512
ad1c7b9400b98fba6d6b3c773717f151dcf8df80f2d711509adc9d5b30f9e2e7c5fc1fab8090fe80521bc1568218898b6da3396ff88557c0d3e893b4e62ccbc8
-
SSDEEP
98304:BvWWHN1fH0B//M8+JHmTcLG3+4bVMShZOv4Yroygs:B17U//MsTcLGdFhUwYr9
Malware Config
Signatures
-
Glupteba payload 35 IoCs
Processes:
resource yara_rule behavioral2/memory/3024-2-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral2/memory/3024-3-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/3024-73-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/3024-301-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/3024-303-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral2/memory/3024-305-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5096-308-0x0000000005080000-0x000000000596B000-memory.dmp family_glupteba behavioral2/memory/5096-309-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5096-561-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5096-808-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5096-1053-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1057-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1058-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1306-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1579-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1806-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1814-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1816-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1818-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1820-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1822-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1824-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1826-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1828-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1830-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1832-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1834-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1836-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1838-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1840-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1842-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1844-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1846-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1848-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2276-1850-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba -
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 820 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2276 csrss.exe 4584 injector.exe 3208 windefender.exe 776 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/3208-1813-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/776-1815-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/776-1819-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe -
Drops file in Windows directory 4 IoCs
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe File created C:\Windows\rss\csrss.exe 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2836 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5016 schtasks.exe 3572 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exewindefender.exe2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exepowershell.exe2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 608 powershell.exe 608 powershell.exe 608 powershell.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe 208 powershell.exe 208 powershell.exe 208 powershell.exe 396 powershell.exe 396 powershell.exe 396 powershell.exe 2868 powershell.exe 2868 powershell.exe 2868 powershell.exe 2836 powershell.exe 2836 powershell.exe 2836 powershell.exe 4768 powershell.exe 4768 powershell.exe 4768 powershell.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 2276 csrss.exe 2276 csrss.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 2276 csrss.exe 2276 csrss.exe 4584 injector.exe 4584 injector.exe 2276 csrss.exe 2276 csrss.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe 4584 injector.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
powershell.exe2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exedescription pid process Token: SeDebugPrivilege 3388 powershell.exe Token: SeDebugPrivilege 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Token: SeImpersonatePrivilege 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe Token: SeDebugPrivilege 608 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 396 powershell.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeSystemEnvironmentPrivilege 2276 csrss.exe Token: SeSecurityPrivilege 2836 sc.exe Token: SeSecurityPrivilege 2836 sc.exe Token: SeDebugPrivilege 4364 powershell.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3024 wrote to memory of 3388 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 3024 wrote to memory of 3388 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 3024 wrote to memory of 3388 3024 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 608 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 608 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 608 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 4804 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe cmd.exe PID 5096 wrote to memory of 4804 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe cmd.exe PID 4804 wrote to memory of 820 4804 cmd.exe netsh.exe PID 4804 wrote to memory of 820 4804 cmd.exe netsh.exe PID 5096 wrote to memory of 208 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 208 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 208 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 396 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 396 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 396 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe powershell.exe PID 5096 wrote to memory of 2276 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe csrss.exe PID 5096 wrote to memory of 2276 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe csrss.exe PID 5096 wrote to memory of 2276 5096 2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe csrss.exe PID 2276 wrote to memory of 2868 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 2868 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 2868 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 2836 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 2836 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 2836 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4768 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4768 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4768 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4584 2276 csrss.exe injector.exe PID 2276 wrote to memory of 4584 2276 csrss.exe injector.exe PID 3208 wrote to memory of 1948 3208 windefender.exe cmd.exe PID 3208 wrote to memory of 1948 3208 windefender.exe cmd.exe PID 3208 wrote to memory of 1948 3208 windefender.exe cmd.exe PID 1948 wrote to memory of 2836 1948 cmd.exe sc.exe PID 1948 wrote to memory of 2836 1948 cmd.exe sc.exe PID 1948 wrote to memory of 2836 1948 cmd.exe sc.exe PID 2276 wrote to memory of 4364 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4364 2276 csrss.exe powershell.exe PID 2276 wrote to memory of 4364 2276 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe"C:\Users\Admin\AppData\Local\Temp\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe"C:\Users\Admin\AppData\Local\Temp\2bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l41gjizq.h12.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD536d9d0f01858e0eb35db65d2449d9a5e
SHA1cdb50c86e6587c25478f8eb9d1692add5ca33244
SHA2569a2e82175f9721f7cbe908c2cf7b9d2325f84857ce68909b937a3400e29b30ac
SHA5129f5de0422903c94063ef6312c346c6171412bcdda7a02900876084d009525c3c696e9b8197d7aa469d7c330349bac82b652f9bc71457c02d95ddc73e644a857a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5c32df28671f3fed9643e744472756e40
SHA1fe0ff2adb2a54e54ee5a87469e70e8037cf5ac4e
SHA2569fd7cf76a53e1eb2af72191c8cd9d03f2c7a4de12b59e200a72e1c10a6e9e747
SHA512d8efad1f21f67ef5b22a546c2c0d3bbd1b6ad1241c3122367ffb072a938a20f0d40476e3dd191adb864eb6cf7333ca4628d9bf33f5c43d78a8297448cb928e52
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD51a53be36fac596aeb778d5a2036a59d1
SHA13152210eda8600298275ee257510593e64538c81
SHA256e830117afb70ce994fb02099c217b00d94977f685d7ea3052df9085a08b236fe
SHA512de020f0fcdbbffab777729ac38cc2d6ae4114f7af0f1cc248df3a4962fb972e14dc2acfce0dcd61ab9483c2f7c0b39ed7383deea3276922f158db20b14bbc3cc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD594307a0a14aacae57ccfc855889cccea
SHA177c1528c40b5d4baef171bc09ed66305ac2c2e90
SHA25609ef2bcd0c01f9b2d87ba53afb1e2e1399e854912877a99c579c093c5b0b91c9
SHA51285b835e09e5ecb74522a9e3e939e9354bc1a223670ee3056ed54c180342c0c9fd82d832dc9c6d19bcc9a429eae590d8f2e4e4816c63ad3a6c27918254b80426f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5072e31883058cd65ccbd4c246c6462c9
SHA1546dff0722b4746fa9a7cb03aedec8788a40d231
SHA25619a488d97307bf4bc62383f709ec4c4ad6a15d65eae1b4781c95a886f3849d20
SHA5123b980785556c872d4d78442879bf106ba9e45a3328af9ca1654d0e558b883e4a5f9c95c80139439b961c99f9dab7e68efc47f92bc69919189f3e74a478b12ed5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD56d7998e76f41bfb3e0739866dc3f6720
SHA149b7d5af13d15eea0074886708c7473cfd4c1b52
SHA25677cb5ce14c58756c94fd6cd7054d5879bfb12b3f8c5c453949113abbfe258de4
SHA512718a3e94437e2609053d634e6ff17c001a258a4c7fe668873b8e293583adfb9eb8c0d89dd796aa2aacf7e9ebbb13244f2a0aa97c994f06e8b17ca5f4a65f0965
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51af71dd16e660e3feb1290f8563b7cae
SHA14816758a46639e32535635ee5c77dac74ffdffc8
SHA2562bf803f380f3e89c4cecfacd37f0966b8ded6d63ab2328f1af1b5c58a5201d0b
SHA512ad1c7b9400b98fba6d6b3c773717f151dcf8df80f2d711509adc9d5b30f9e2e7c5fc1fab8090fe80521bc1568218898b6da3396ff88557c0d3e893b4e62ccbc8
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/208-563-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/208-591-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/208-562-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/208-564-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/208-565-0x00000000078F0000-0x0000000007C40000-memory.dmpFilesize
3.3MB
-
memory/208-585-0x000000006FBB0000-0x000000006FBFB000-memory.dmpFilesize
300KB
-
memory/208-586-0x000000006FC20000-0x000000006FF70000-memory.dmpFilesize
3.3MB
-
memory/208-804-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/396-831-0x000000006FC20000-0x000000006FF70000-memory.dmpFilesize
3.3MB
-
memory/396-807-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/396-810-0x0000000006680000-0x0000000006690000-memory.dmpFilesize
64KB
-
memory/396-1049-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/396-809-0x0000000006680000-0x0000000006690000-memory.dmpFilesize
64KB
-
memory/396-830-0x000000006FBB0000-0x000000006FBFB000-memory.dmpFilesize
300KB
-
memory/396-836-0x0000000006680000-0x0000000006690000-memory.dmpFilesize
64KB
-
memory/608-314-0x00000000073D0000-0x0000000007720000-memory.dmpFilesize
3.3MB
-
memory/608-336-0x000000006FC00000-0x000000006FF50000-memory.dmpFilesize
3.3MB
-
memory/608-557-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/608-342-0x00000000065E0000-0x00000000065F0000-memory.dmpFilesize
64KB
-
memory/608-341-0x0000000008E40000-0x0000000008EE5000-memory.dmpFilesize
660KB
-
memory/608-335-0x000000007E750000-0x000000007E760000-memory.dmpFilesize
64KB
-
memory/608-334-0x000000006FBB0000-0x000000006FBFB000-memory.dmpFilesize
300KB
-
memory/608-315-0x0000000007E10000-0x0000000007E5B000-memory.dmpFilesize
300KB
-
memory/608-312-0x0000000072E80000-0x000000007356E000-memory.dmpFilesize
6.9MB
-
memory/608-313-0x00000000065E0000-0x00000000065F0000-memory.dmpFilesize
64KB
-
memory/776-1815-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/776-1819-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2276-1806-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1056-0x0000000003900000-0x0000000003CF9000-memory.dmpFilesize
4.0MB
-
memory/2276-1850-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1848-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1846-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1844-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1842-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1840-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1838-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1836-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1834-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1832-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1830-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1828-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1826-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1824-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1822-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1820-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1818-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1816-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1814-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1579-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1306-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1058-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2276-1057-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2868-1062-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2868-1061-0x0000000072DE0000-0x00000000734CE000-memory.dmpFilesize
6.9MB
-
memory/2868-1065-0x0000000008450000-0x000000000849B000-memory.dmpFilesize
300KB
-
memory/2868-1063-0x0000000007B70000-0x0000000007EC0000-memory.dmpFilesize
3.3MB
-
memory/3024-1-0x00000000032D0000-0x00000000036CD000-memory.dmpFilesize
4.0MB
-
memory/3024-73-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/3024-2-0x0000000005070000-0x000000000595B000-memory.dmpFilesize
8.9MB
-
memory/3024-305-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/3024-303-0x0000000005070000-0x000000000595B000-memory.dmpFilesize
8.9MB
-
memory/3024-301-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/3024-154-0x00000000032D0000-0x00000000036CD000-memory.dmpFilesize
4.0MB
-
memory/3024-3-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/3208-1813-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3388-304-0x0000000072D80000-0x000000007346E000-memory.dmpFilesize
6.9MB
-
memory/3388-85-0x0000000009D50000-0x0000000009DE4000-memory.dmpFilesize
592KB
-
memory/3388-8-0x0000000004810000-0x0000000004820000-memory.dmpFilesize
64KB
-
memory/3388-7-0x0000000072D80000-0x000000007346E000-memory.dmpFilesize
6.9MB
-
memory/3388-66-0x0000000008D50000-0x0000000008DC6000-memory.dmpFilesize
472KB
-
memory/3388-6-0x0000000004720000-0x0000000004756000-memory.dmpFilesize
216KB
-
memory/3388-15-0x0000000007C10000-0x0000000007C2C000-memory.dmpFilesize
112KB
-
memory/3388-9-0x0000000004810000-0x0000000004820000-memory.dmpFilesize
64KB
-
memory/3388-82-0x000000007EC70000-0x000000007EC80000-memory.dmpFilesize
64KB
-
memory/3388-75-0x000000006FA90000-0x000000006FADB000-memory.dmpFilesize
300KB
-
memory/3388-11-0x0000000006E60000-0x0000000006E82000-memory.dmpFilesize
136KB
-
memory/3388-35-0x0000000008C90000-0x0000000008CCC000-memory.dmpFilesize
240KB
-
memory/3388-83-0x0000000009BD0000-0x0000000009C75000-memory.dmpFilesize
660KB
-
memory/3388-16-0x0000000007ED0000-0x0000000007F1B000-memory.dmpFilesize
300KB
-
memory/3388-84-0x0000000004810000-0x0000000004820000-memory.dmpFilesize
64KB
-
memory/3388-77-0x0000000009B70000-0x0000000009B8E000-memory.dmpFilesize
120KB
-
memory/3388-12-0x0000000007730000-0x0000000007796000-memory.dmpFilesize
408KB
-
memory/3388-284-0x0000000009CB0000-0x0000000009CB8000-memory.dmpFilesize
32KB
-
memory/3388-74-0x0000000009B90000-0x0000000009BC3000-memory.dmpFilesize
204KB
-
memory/3388-279-0x0000000009CC0000-0x0000000009CDA000-memory.dmpFilesize
104KB
-
memory/3388-10-0x0000000007090000-0x00000000076B8000-memory.dmpFilesize
6.2MB
-
memory/3388-14-0x0000000007880000-0x0000000007BD0000-memory.dmpFilesize
3.3MB
-
memory/3388-13-0x0000000007810000-0x0000000007876000-memory.dmpFilesize
408KB
-
memory/3388-76-0x000000006FAE0000-0x000000006FE30000-memory.dmpFilesize
3.3MB
-
memory/5096-547-0x0000000003560000-0x0000000003967000-memory.dmpFilesize
4.0MB
-
memory/5096-561-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/5096-1053-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/5096-808-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/5096-307-0x0000000003560000-0x0000000003967000-memory.dmpFilesize
4.0MB
-
memory/5096-308-0x0000000005080000-0x000000000596B000-memory.dmpFilesize
8.9MB
-
memory/5096-309-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB