Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-04-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe
Resource
win10v2004-20240412-en
General
-
Target
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe
-
Size
4.1MB
-
MD5
2fe3dcc8bde7f8e72c297a23d1c99dce
-
SHA1
75e43a843f2191e794881350d0a68c9610f6d4d8
-
SHA256
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1
-
SHA512
6e0ce899887c6ab724710f3986a8dd9482e5e54033f9766aa426d3dfd142b3d7dc26ae3960a7b872c839994f7af30c4843388fd8690a017df88462db80069731
-
SSDEEP
98304:Qupp3WUkLaIVxVQ5Lfi8+DAGSBgUwbhlmIRT0sLJ5m:N24wrgi8oddlbg
Malware Config
Signatures
-
Glupteba payload 36 IoCs
Processes:
resource yara_rule behavioral2/memory/2144-2-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1272-4-0x0000000004140000-0x0000000004A2C000-memory.dmp family_glupteba behavioral2/memory/2144-5-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-6-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-7-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-8-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-9-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-10-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2144-57-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-68-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-69-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-70-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-71-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-72-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-153-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1092-165-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-175-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-176-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-177-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-178-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-205-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-206-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-265-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-271-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-275-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-281-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-283-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-285-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-287-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-289-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-291-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-293-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-295-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-297-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-299-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4800-301-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2088 netsh.exe -
Executes dropped EXE 5 IoCs
Processes:
csrss.execsrss.exeinjector.exewindefender.exewindefender.exepid process 236 csrss.exe 4800 csrss.exe 1984 injector.exe 1608 windefender.exe 2068 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/1608-280-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2068-282-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2068-286-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.execsrss.exedescription pid process target process PID 1272 set thread context of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 set thread context of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 236 set thread context of 4800 236 csrss.exe csrss.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe File created C:\Windows\rss\csrss.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1772 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2924 schtasks.exe 5116 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exewindefender.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exepowershell.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3440 powershell.exe 3440 powershell.exe 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 2784 powershell.exe 2784 powershell.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 2068 powershell.exe 2068 powershell.exe 788 powershell.exe 788 powershell.exe 3964 powershell.exe 3964 powershell.exe 4672 powershell.exe 4672 powershell.exe 4220 powershell.exe 4220 powershell.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 4800 csrss.exe 4800 csrss.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 4800 csrss.exe 4800 csrss.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 4800 csrss.exe 4800 csrss.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe 1984 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3440 powershell.exe Token: SeDebugPrivilege 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Token: SeImpersonatePrivilege 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 4672 powershell.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeSystemEnvironmentPrivilege 4800 csrss.exe Token: SeSecurityPrivilege 1772 sc.exe Token: SeSecurityPrivilege 1772 sc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.execmd.execsrss.execsrss.exewindefender.exedescription pid process target process PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1272 wrote to memory of 2144 1272 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 2144 wrote to memory of 3440 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 2144 wrote to memory of 3440 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 2144 wrote to memory of 3440 2144 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 4796 wrote to memory of 1092 4796 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe PID 1092 wrote to memory of 2784 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 2784 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 2784 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 3036 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe cmd.exe PID 1092 wrote to memory of 3036 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe cmd.exe PID 3036 wrote to memory of 2088 3036 cmd.exe netsh.exe PID 3036 wrote to memory of 2088 3036 cmd.exe netsh.exe PID 1092 wrote to memory of 2068 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 2068 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 2068 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 788 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 788 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 788 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe powershell.exe PID 1092 wrote to memory of 236 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe csrss.exe PID 1092 wrote to memory of 236 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe csrss.exe PID 1092 wrote to memory of 236 1092 36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 236 wrote to memory of 4800 236 csrss.exe csrss.exe PID 4800 wrote to memory of 3964 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 3964 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 3964 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4672 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4672 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4672 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4220 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4220 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 4220 4800 csrss.exe powershell.exe PID 4800 wrote to memory of 1984 4800 csrss.exe injector.exe PID 4800 wrote to memory of 1984 4800 csrss.exe injector.exe PID 1608 wrote to memory of 1912 1608 windefender.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"C:\Users\Admin\AppData\Local\Temp\36fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1.exe"4⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:2088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:2924 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵PID:900
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1984 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:5116 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵PID:1912
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2068
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzpo3cis.lto.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c34e7ffaeed3af5131e19faaf6a4950c
SHA1658d002752940c48e76e3be7a6a4af88883d6d73
SHA2568ce69760a25ac64acdd21d094a3b46bc9f2d46181796b3fe7a4d4647a01dc687
SHA512f532f5903bd2ab22a6f5855b5dd50e982bc0ca8b26175a146a6f8ac27a2d61fd6f66d572734f916d1d06670ec3beaf47004b3be6458dd303b9c53e1873c8fc68
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5bd2e16c07f14994bd9aee392b9ab258b
SHA15d099dea102fd647bfa898e15382be816899c67a
SHA2566a510245d746e6a884e59b50065ae8b458a9e70d5248a0c5aede7243ac938155
SHA512ef638d79b9b7c3fb4a5eebab73d50e88e80237c2a60b88eeaf829c5fc97125be84a0c219043eb1c99efb16afb4878b219944c736198b02109b2777c53a8ca2a2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52d36e98cdc114fd3674a4417bd7cba20
SHA12043724056f3f050575891a1fc6bec1d53385917
SHA2567b69d93e180799d1b02a8d4ec529b8bf7dd7d55e4613415b5cb32627e2d452c9
SHA512daefbe0c0ec35ee377927a2b23f93292a32812194562dfcb5cb9e44b607a22152d58aa13736a1271321a004eb7a1684c37381dd3ae5e46ccb54af18b9082d0e6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a5d6c46381a3b5b70edfa6f0d0bcab8a
SHA1bf14c2741dc471a3220b211717545e2704ee5967
SHA2563c8d32e8650f28a83a05e737395ed68896a4843e946230a005f8c746f99969a7
SHA5121cee21e092245dd9464f6bc9c228f6c74ba6454e44f5932d07eef609849fc2ac3d819863fff9a062ffd77d8cd6590fa95ab37d49370895efa4602d40b9d2003d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD516a51f8d96657bd2e0080886c69bf8a2
SHA1f78fda6d9d0405addf9135d93f73c8edc3425806
SHA256925554a76b01c26d665d8d5bd65fd324c1c36ce4180bbdb634702826b30dc1b8
SHA51215516312b46be091388de754f00cadc895a249ba20b7c637240accb57c1b5fb76b7990032c7e61c6e4907e67d3e1941fa81974f86faa40b9cf7c309f1ba14a30
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD52fe3dcc8bde7f8e72c297a23d1c99dce
SHA175e43a843f2191e794881350d0a68c9610f6d4d8
SHA25636fd8432809e1ed5befada3547526b296686939365446bd23a437a5fc7e26ec1
SHA5126e0ce899887c6ab724710f3986a8dd9482e5e54033f9766aa426d3dfd142b3d7dc26ae3960a7b872c839994f7af30c4843388fd8690a017df88462db80069731
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/236-170-0x0000000004000000-0x0000000004400000-memory.dmpFilesize
4.0MB
-
memory/788-132-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/788-156-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/788-142-0x000000007F7B0000-0x000000007F7C0000-memory.dmpFilesize
64KB
-
memory/788-143-0x0000000070BA0000-0x0000000070BEC000-memory.dmpFilesize
304KB
-
memory/788-144-0x0000000070DF0000-0x0000000071147000-memory.dmpFilesize
3.3MB
-
memory/788-131-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/788-154-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/1092-69-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-165-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-153-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-68-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-70-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-71-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1092-72-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1272-4-0x0000000004140000-0x0000000004A2C000-memory.dmpFilesize
8.9MB
-
memory/1272-1-0x0000000003D40000-0x000000000413F000-memory.dmpFilesize
4.0MB
-
memory/1608-280-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2068-118-0x0000000070BA0000-0x0000000070BEC000-memory.dmpFilesize
304KB
-
memory/2068-104-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/2068-106-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/2068-130-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/2068-128-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/2068-119-0x0000000070DF0000-0x0000000071147000-memory.dmpFilesize
3.3MB
-
memory/2068-282-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2068-117-0x000000007F0E0000-0x000000007F0F0000-memory.dmpFilesize
64KB
-
memory/2068-105-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/2068-107-0x0000000005B60000-0x0000000005EB7000-memory.dmpFilesize
3.3MB
-
memory/2068-286-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2144-7-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-8-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-9-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-10-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-57-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-6-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-5-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2144-2-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2784-84-0x0000000006DC0000-0x0000000006E0C000-memory.dmpFilesize
304KB
-
memory/2784-80-0x0000000006320000-0x0000000006677000-memory.dmpFilesize
3.3MB
-
memory/2784-85-0x000000007EED0000-0x000000007EEE0000-memory.dmpFilesize
64KB
-
memory/2784-86-0x0000000070BA0000-0x0000000070BEC000-memory.dmpFilesize
304KB
-
memory/2784-87-0x0000000070DB0000-0x0000000071107000-memory.dmpFilesize
3.3MB
-
memory/2784-96-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/2784-97-0x0000000007A70000-0x0000000007B14000-memory.dmpFilesize
656KB
-
memory/2784-98-0x0000000007DB0000-0x0000000007DC1000-memory.dmpFilesize
68KB
-
memory/2784-99-0x0000000007E00000-0x0000000007E15000-memory.dmpFilesize
84KB
-
memory/2784-102-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/2784-74-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/2784-73-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/3440-30-0x000000007FB10000-0x000000007FB20000-memory.dmpFilesize
64KB
-
memory/3440-26-0x00000000058B0000-0x0000000005C07000-memory.dmpFilesize
3.3MB
-
memory/3440-56-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/3440-53-0x00000000074B0000-0x00000000074B8000-memory.dmpFilesize
32KB
-
memory/3440-52-0x0000000007490000-0x00000000074AA000-memory.dmpFilesize
104KB
-
memory/3440-51-0x0000000007440000-0x0000000007455000-memory.dmpFilesize
84KB
-
memory/3440-50-0x0000000007430000-0x000000000743E000-memory.dmpFilesize
56KB
-
memory/3440-49-0x00000000073E0000-0x00000000073F1000-memory.dmpFilesize
68KB
-
memory/3440-48-0x00000000074D0000-0x0000000007566000-memory.dmpFilesize
600KB
-
memory/3440-47-0x00000000073C0000-0x00000000073CA000-memory.dmpFilesize
40KB
-
memory/3440-45-0x00000000079C0000-0x000000000803A000-memory.dmpFilesize
6.5MB
-
memory/3440-46-0x0000000007380000-0x000000000739A000-memory.dmpFilesize
104KB
-
memory/3440-42-0x0000000007230000-0x000000000724E000-memory.dmpFilesize
120KB
-
memory/3440-44-0x0000000007250000-0x00000000072F4000-memory.dmpFilesize
656KB
-
memory/3440-43-0x00000000029D0000-0x00000000029E0000-memory.dmpFilesize
64KB
-
memory/3440-32-0x0000000070B30000-0x0000000070B7C000-memory.dmpFilesize
304KB
-
memory/3440-33-0x0000000070CB0000-0x0000000071007000-memory.dmpFilesize
3.3MB
-
memory/3440-31-0x00000000071F0000-0x0000000007224000-memory.dmpFilesize
208KB
-
memory/3440-29-0x0000000006300000-0x0000000006346000-memory.dmpFilesize
280KB
-
memory/3440-28-0x0000000005D80000-0x0000000005DCC000-memory.dmpFilesize
304KB
-
memory/3440-27-0x0000000005D30000-0x0000000005D4E000-memory.dmpFilesize
120KB
-
memory/3440-11-0x00000000028A0000-0x00000000028D6000-memory.dmpFilesize
216KB
-
memory/3440-13-0x0000000005040000-0x000000000566A000-memory.dmpFilesize
6.2MB
-
memory/3440-14-0x00000000029D0000-0x00000000029E0000-memory.dmpFilesize
64KB
-
memory/3440-12-0x00000000748C0000-0x0000000075071000-memory.dmpFilesize
7.7MB
-
memory/3440-15-0x0000000004FB0000-0x0000000004FD2000-memory.dmpFilesize
136KB
-
memory/3440-16-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/3440-17-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/4796-64-0x0000000003B40000-0x0000000003F45000-memory.dmpFilesize
4.0MB
-
memory/4800-283-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-297-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-205-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-271-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-178-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-275-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-177-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-285-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-301-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-265-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-281-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-175-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-287-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-289-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-291-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-293-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-295-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-206-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-299-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4800-176-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB