Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-04-2024 13:08
Static task
static1
Behavioral task
behavioral1
Sample
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe
Resource
win10v2004-20240412-en
General
-
Target
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe
-
Size
4.1MB
-
MD5
a74888ba0ad66d647b5a24ad2ecd8b8d
-
SHA1
3adb4202f155f268a9b303c8dd2c2afaf0d76163
-
SHA256
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c
-
SHA512
f7f142a28a14650939fd1a614a112c0413421e28355bd07362a0ebd7b47f8108e55f41ed740a801a518f54d708a372b24877b39ee4423996ea9d33df9e9707c1
-
SSDEEP
98304:Qupp3WUkLaIVxVQ5Lfi8+DAGSBgUwbhlmIRT0sLJ5h:N24wrgi8oddlbP
Malware Config
Signatures
-
Glupteba payload 35 IoCs
Processes:
resource yara_rule behavioral2/memory/1204-2-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4808-4-0x0000000004160000-0x0000000004A4C000-memory.dmp family_glupteba behavioral2/memory/1204-5-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-6-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-8-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-7-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-9-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-10-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1204-58-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-69-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-70-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-71-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-72-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-143-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/780-160-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-176-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-177-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-178-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-206-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-237-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-268-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-269-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-270-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-271-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-280-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-282-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-284-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-286-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-288-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-290-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-292-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-294-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-296-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-298-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/348-300-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2780 netsh.exe -
Executes dropped EXE 5 IoCs
Processes:
csrss.execsrss.exeinjector.exewindefender.exewindefender.exepid process 2540 csrss.exe 348 csrss.exe 828 injector.exe 3136 windefender.exe 2004 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/3136-279-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2004-281-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2004-285-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.execsrss.exedescription pid process target process PID 4808 set thread context of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 set thread context of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2540 set thread context of 348 2540 csrss.exe csrss.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe -
Drops file in Windows directory 4 IoCs
Processes:
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe File created C:\Windows\rss\csrss.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4940 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 652 schtasks.exe 4696 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exepowershell.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3812 powershell.exe 3812 powershell.exe 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 4464 powershell.exe 4464 powershell.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 4768 powershell.exe 4768 powershell.exe 3144 powershell.exe 3144 powershell.exe 3940 powershell.exe 3940 powershell.exe 1564 powershell.exe 1564 powershell.exe 3960 powershell.exe 3960 powershell.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 348 csrss.exe 348 csrss.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 348 csrss.exe 348 csrss.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe 828 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3812 powershell.exe Token: SeDebugPrivilege 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Token: SeImpersonatePrivilege 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 1564 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeSystemEnvironmentPrivilege 348 csrss.exe Token: SeSecurityPrivilege 4940 sc.exe Token: SeSecurityPrivilege 4940 sc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.execmd.execsrss.execsrss.exewindefender.exedescription pid process target process PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 4808 wrote to memory of 1204 4808 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 1204 wrote to memory of 3812 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 1204 wrote to memory of 3812 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 1204 wrote to memory of 3812 1204 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 2816 wrote to memory of 780 2816 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe PID 780 wrote to memory of 4464 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 4464 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 4464 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 4024 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe cmd.exe PID 780 wrote to memory of 4024 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe cmd.exe PID 4024 wrote to memory of 2780 4024 cmd.exe netsh.exe PID 4024 wrote to memory of 2780 4024 cmd.exe netsh.exe PID 780 wrote to memory of 4768 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 4768 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 4768 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 3144 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 3144 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 3144 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe powershell.exe PID 780 wrote to memory of 2540 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe csrss.exe PID 780 wrote to memory of 2540 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe csrss.exe PID 780 wrote to memory of 2540 780 1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 2540 wrote to memory of 348 2540 csrss.exe csrss.exe PID 348 wrote to memory of 3940 348 csrss.exe powershell.exe PID 348 wrote to memory of 3940 348 csrss.exe powershell.exe PID 348 wrote to memory of 3940 348 csrss.exe powershell.exe PID 348 wrote to memory of 1564 348 csrss.exe powershell.exe PID 348 wrote to memory of 1564 348 csrss.exe powershell.exe PID 348 wrote to memory of 1564 348 csrss.exe powershell.exe PID 348 wrote to memory of 3960 348 csrss.exe powershell.exe PID 348 wrote to memory of 3960 348 csrss.exe powershell.exe PID 348 wrote to memory of 3960 348 csrss.exe powershell.exe PID 348 wrote to memory of 828 348 csrss.exe injector.exe PID 348 wrote to memory of 828 348 csrss.exe injector.exe PID 3136 wrote to memory of 3816 3136 windefender.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"C:\Users\Admin\AppData\Local\Temp\1de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c.exe"4⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:652 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵PID:4164
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:828 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:4696 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵PID:3816
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2004
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vigcw315.2xw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5400620c92df6430f5d27c610a25182ca
SHA1df0006df25cd390738e83deae2f64fe7d615c715
SHA2569297d41cff94f4e3f70174eb31cfed54bf0c2cb75b9ecec5da2d518068bfea60
SHA5123cdce0300a2609a4da644ad97de5978d06587dd3e4e2702d7bb1e7f570fd42edb01bbcb7c695cf24be1f217d8bdb937b88ebe6a518c0240ab0edf0043e62e819
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD55dff5766b8e62ebcd50708d078bc52fe
SHA143cc0ae9a2c0183c02daa20d19fdb943dd70cc7e
SHA2565ec69a3a06b2c6130da381cd7698aad599c81dfda3609027479271687d3b6e7d
SHA512925890066ecb167de981b0766013eb6cf0140e0a704d6ffdaabeb308981f1fc42b49a9020c4a5870243567fe3a7bd76286e0caa65ba306679456803c36b208de
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a8b32623f54a7e492d926534e8af578b
SHA16d7a5317837e0b874350f9d97dadc171f1438c84
SHA25691ba3ee2ea21b4db5d9c03f69be55cb2b93b80db951d67e7c01d733c96d53eec
SHA512acfd7b00fb6f291ea55505d22cb9b7ca2b5f5a9073bf09995e779c37cc1ce74eff97b1ace70c0bfcc11b481a9b030d1e6bc147d8c0389eae5c76969cf769bd0a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD592dda81fc58d6802d10c50ab4419c37b
SHA19bb215043c9bf17206241ebe81d396498706cff3
SHA256434ef8e5a27e01f6dea2c9d68cdf3986b9bef4203c199681cdec1ecdd8b0e347
SHA5128a79ae5ff1622ffaee0a21043e8eec983d8337a246c60ebfe517f9199edcbe0e5dd85116de77a0e13f6a50d913db03e7aeb758fd54fece4287a961d0e4ad7c37
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5132ebf2de22de919197136af0466da20
SHA12c615ede4835d032b4e2cc88095c0073df52a08a
SHA256377f141952d0ff3fc0aaf40378cefade994e04ea01094afc95d582b80c1bcd48
SHA5128fff0abf99c5a9fce3910109e5e0fb36ef571edbf72997aa133ae303d943650076fc9dace738e44642e526f63470009d5c5a3878dba44a2b91405f1e93db35f9
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5a74888ba0ad66d647b5a24ad2ecd8b8d
SHA13adb4202f155f268a9b303c8dd2c2afaf0d76163
SHA2561de387654f61a0c348ff00ff0002cef7f8cb3bcd3a550f010866820aea28898c
SHA512f7f142a28a14650939fd1a614a112c0413421e28355bd07362a0ebd7b47f8108e55f41ed740a801a518f54d708a372b24877b39ee4423996ea9d33df9e9707c1
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/348-288-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-282-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-292-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-290-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-296-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-286-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-300-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-298-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-284-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-237-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-177-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-280-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-178-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-176-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-271-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-270-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-269-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-268-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-294-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/348-206-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-72-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-69-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-70-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-71-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-160-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/780-143-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-6-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-5-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-58-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-8-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-7-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-9-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-10-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1204-2-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2004-281-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2004-285-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2540-169-0x0000000004000000-0x0000000004400000-memory.dmpFilesize
4.0MB
-
memory/2816-65-0x0000000003A80000-0x0000000003E85000-memory.dmpFilesize
4.0MB
-
memory/3136-279-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3144-155-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/3144-145-0x00000000711B0000-0x0000000071507000-memory.dmpFilesize
3.3MB
-
memory/3144-154-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/3144-142-0x0000000071010000-0x000000007105C000-memory.dmpFilesize
304KB
-
memory/3144-144-0x000000007EE70000-0x000000007EE80000-memory.dmpFilesize
64KB
-
memory/3144-140-0x0000000005C70000-0x0000000005FC7000-memory.dmpFilesize
3.3MB
-
memory/3144-131-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/3144-130-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/3144-157-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/3812-44-0x0000000007660000-0x000000000767E000-memory.dmpFilesize
120KB
-
memory/3812-31-0x000000007FB50000-0x000000007FB60000-memory.dmpFilesize
64KB
-
memory/3812-11-0x0000000004D40000-0x0000000004D76000-memory.dmpFilesize
216KB
-
memory/3812-12-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/3812-15-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/3812-14-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/3812-13-0x00000000053E0000-0x0000000005A0A000-memory.dmpFilesize
6.2MB
-
memory/3812-16-0x0000000005330000-0x0000000005352000-memory.dmpFilesize
136KB
-
memory/3812-17-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/3812-18-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/3812-27-0x0000000005DB0000-0x0000000006107000-memory.dmpFilesize
3.3MB
-
memory/3812-28-0x00000000061E0000-0x00000000061FE000-memory.dmpFilesize
120KB
-
memory/3812-29-0x0000000006230000-0x000000000627C000-memory.dmpFilesize
304KB
-
memory/3812-30-0x0000000006760000-0x00000000067A6000-memory.dmpFilesize
280KB
-
memory/3812-33-0x0000000070FA0000-0x0000000070FEC000-memory.dmpFilesize
304KB
-
memory/3812-32-0x0000000007620000-0x0000000007654000-memory.dmpFilesize
208KB
-
memory/3812-35-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/3812-45-0x0000000007680000-0x0000000007724000-memory.dmpFilesize
656KB
-
memory/3812-34-0x0000000071140000-0x0000000071497000-memory.dmpFilesize
3.3MB
-
memory/3812-46-0x0000000007DF0000-0x000000000846A000-memory.dmpFilesize
6.5MB
-
memory/3812-47-0x00000000077B0000-0x00000000077CA000-memory.dmpFilesize
104KB
-
memory/3812-57-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/3812-54-0x00000000078E0000-0x00000000078E8000-memory.dmpFilesize
32KB
-
memory/3812-53-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/3812-52-0x0000000007870000-0x0000000007885000-memory.dmpFilesize
84KB
-
memory/3812-51-0x0000000007860000-0x000000000786E000-memory.dmpFilesize
56KB
-
memory/3812-50-0x0000000007810000-0x0000000007821000-memory.dmpFilesize
68KB
-
memory/3812-49-0x0000000007900000-0x0000000007996000-memory.dmpFilesize
600KB
-
memory/3812-48-0x00000000077F0000-0x00000000077FA000-memory.dmpFilesize
40KB
-
memory/4464-86-0x0000000071010000-0x000000007105C000-memory.dmpFilesize
304KB
-
memory/4464-83-0x0000000005510000-0x0000000005867000-memory.dmpFilesize
3.3MB
-
memory/4464-98-0x0000000006F80000-0x0000000006F91000-memory.dmpFilesize
68KB
-
memory/4464-73-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/4464-84-0x0000000005A90000-0x0000000005ADC000-memory.dmpFilesize
304KB
-
memory/4464-85-0x000000007FBC0000-0x000000007FBD0000-memory.dmpFilesize
64KB
-
memory/4464-97-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/4464-96-0x0000000006C60000-0x0000000006D04000-memory.dmpFilesize
656KB
-
memory/4464-99-0x0000000006FD0000-0x0000000006FE5000-memory.dmpFilesize
84KB
-
memory/4464-87-0x0000000071260000-0x00000000715B7000-memory.dmpFilesize
3.3MB
-
memory/4464-102-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/4464-74-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/4768-106-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4768-129-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/4768-127-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4768-126-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4768-117-0x0000000071260000-0x00000000715B7000-memory.dmpFilesize
3.3MB
-
memory/4768-116-0x0000000071010000-0x000000007105C000-memory.dmpFilesize
304KB
-
memory/4768-104-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/4768-105-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4808-4-0x0000000004160000-0x0000000004A4C000-memory.dmpFilesize
8.9MB
-
memory/4808-1-0x0000000003D50000-0x0000000004156000-memory.dmpFilesize
4.0MB