Malware Analysis Report

2024-12-08 02:13

Sample ID 240516-pv5z1sde43
Target 95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1
SHA256 95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1

Threat Level: Known bad

The file 95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 12:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 12:39

Reported

2024-05-16 12:42

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4856 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\system32\cmd.exe
PID 2560 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\system32\cmd.exe
PID 4396 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4396 wrote to memory of 4876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2560 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe
PID 2560 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe
PID 2560 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe
PID 2124 wrote to memory of 1056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 1056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 1056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 4208 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2124 wrote to memory of 4208 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2556 wrote to memory of 3620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2556 wrote to memory of 3620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2556 wrote to memory of 3620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3620 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3620 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3620 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 168.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 7ef02260-4975-48a8-98d7-ffc5fefb54ba.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server9.databaseupgrade.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun2.l.google.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server9.databaseupgrade.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BG 185.82.216.108:443 server9.databaseupgrade.ru tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BG 185.82.216.108:443 server9.databaseupgrade.ru tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:31465 tcp

Files

memory/4856-1-0x0000000002920000-0x0000000002D23000-memory.dmp

memory/4856-2-0x0000000002D30000-0x000000000361B000-memory.dmp

memory/4856-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1356-4-0x000000007413E000-0x000000007413F000-memory.dmp

memory/1356-5-0x0000000002580000-0x00000000025B6000-memory.dmp

memory/1356-7-0x0000000004D30000-0x0000000005358000-memory.dmp

memory/1356-6-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/1356-8-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/1356-9-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pkza5h1.sqj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1356-10-0x0000000005490000-0x00000000054F6000-memory.dmp

memory/1356-11-0x0000000005530000-0x0000000005596000-memory.dmp

memory/1356-21-0x00000000055A0000-0x00000000058F4000-memory.dmp

memory/1356-22-0x0000000005B60000-0x0000000005B7E000-memory.dmp

memory/1356-23-0x0000000005C20000-0x0000000005C6C000-memory.dmp

memory/1356-24-0x00000000060B0000-0x00000000060F4000-memory.dmp

memory/1356-25-0x0000000006E90000-0x0000000006F06000-memory.dmp

memory/1356-27-0x0000000006F30000-0x0000000006F4A000-memory.dmp

memory/1356-26-0x0000000007590000-0x0000000007C0A000-memory.dmp

memory/1356-29-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/1356-28-0x00000000070F0000-0x0000000007122000-memory.dmp

memory/1356-42-0x0000000007150000-0x00000000071F3000-memory.dmp

memory/1356-41-0x0000000007130000-0x000000000714E000-memory.dmp

memory/1356-31-0x0000000070180000-0x00000000704D4000-memory.dmp

memory/1356-30-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/1356-43-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/1356-44-0x0000000007240000-0x000000000724A000-memory.dmp

memory/1356-45-0x0000000007350000-0x00000000073E6000-memory.dmp

memory/1356-46-0x0000000007250000-0x0000000007261000-memory.dmp

memory/1356-47-0x0000000007290000-0x000000000729E000-memory.dmp

memory/1356-48-0x00000000072B0000-0x00000000072C4000-memory.dmp

memory/1356-49-0x0000000007300000-0x000000000731A000-memory.dmp

memory/1356-50-0x00000000072F0000-0x00000000072F8000-memory.dmp

memory/1356-53-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/2560-55-0x00000000029E0000-0x0000000002DE7000-memory.dmp

memory/4896-61-0x0000000006060000-0x00000000063B4000-memory.dmp

memory/4896-67-0x0000000070D80000-0x00000000710D4000-memory.dmp

memory/4896-77-0x0000000007980000-0x0000000007A23000-memory.dmp

memory/4896-66-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/4896-78-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

memory/4896-79-0x0000000007CF0000-0x0000000007D04000-memory.dmp

memory/4856-82-0x0000000002920000-0x0000000002D23000-memory.dmp

memory/4856-83-0x0000000002D30000-0x000000000361B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/2600-94-0x00000000060C0000-0x0000000006414000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cceb1c23ec25c9f59b7207cb3de0d5c5
SHA1 99546233789efee03527d1bd2763cc4470b1d64d
SHA256 22741a59efaa0d23042696254fff958a770f8927500b206ccda8669c9916bafc
SHA512 02dedf8a701415d95a9a7f683bc241071adb5a8e8906e7a593fe41568f8527969075e342db60431f879d2ac075d491a934f463adc48b967c5e8431ab94fdd91f

memory/2600-96-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/2600-97-0x0000000070150000-0x00000000704A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 56c7c6564467ec0f0b88778880e4774e
SHA1 7bd2d5834654f1b855960420870ce8d4a341d744
SHA256 b60da6857c8063fb7d57bf7ef9547282b0d4b2a0aed34ddb42605fba2470aae9
SHA512 054864f4015c8f01428446dff5fc7112092c1321041598eb78b0347f34f6b1ce098162f30cf7ecd610753ad606554126d88021df5c2cef8c4fe557713fe7cbf6

memory/4856-118-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4548-119-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/4548-120-0x0000000070150000-0x00000000704A4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 f3f1ea24c7557fd69b44b32d848b7aa6
SHA1 f18c7bcbb3231c8147bb799f2e8d1b46bcf30acb
SHA256 95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1
SHA512 7b32346d7bb6fe4465b611e3b615a9a9061d767c4fe67136f988902f0a8e6d694a0d5e2459719387345f8704ac39b6807ae7e58921011c9add028633bc23a710

memory/2560-134-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 62b760ab905eda163c5787eb2b9d6505
SHA1 fee977166f4f0c4cb2e38f893b1bbc2fc218f1d0
SHA256 d5744c7b06ae8396dffff77926ee13e87d4a4e67173c434911e2b389aa23b64b
SHA512 70d7533801fd490bb773194f6c859f40c184da10a0defd7586fa8e77ab1f86602a3e2e13635ee89448dda39d516014cebd99e51e9ca82e9d2ca47ced7fa4d0b5

memory/1056-147-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/1056-148-0x0000000070150000-0x00000000704A4000-memory.dmp

memory/544-168-0x0000000005D60000-0x00000000060B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7eb81625e920f614621620b85d418c22
SHA1 6e624c2063ce6e1e0adaa052835fa79c2827b0a0
SHA256 dc918dbfed0f83fe31df68ecec8db2c08268442c150fee8aca63807fcd0cd7c4
SHA512 d930f3fd05bb38396b9892728985ae3b9c618f5661a2449ed68595cf0da34fb50898fbb2cf03fa4a6872204f3b0e0255f07337e71fa00ec1914ba748feeec35f

memory/544-170-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/544-172-0x0000000070070000-0x00000000703C4000-memory.dmp

memory/544-171-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

memory/544-182-0x00000000074A0000-0x0000000007543000-memory.dmp

memory/544-183-0x0000000007820000-0x0000000007831000-memory.dmp

memory/544-184-0x0000000005C00000-0x0000000005C14000-memory.dmp

memory/3784-186-0x00000000061E0000-0x0000000006534000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2a297eb8909e66c052f572c2bd5f5e2d
SHA1 d1e92ff582948dcc9b0e9b4f6765b798545983eb
SHA256 8be31d74075f8b78ee6660a9097c6c2c8f5ef6bfb05ef2380d069e9c17be33c0
SHA512 44bbf9a6146f242bbec93b7161e0b59cd1652fdf5cc6a0c4c907c6e667bd42071fd9580d9b8b45ed3231f6770bf29a9716e90f06b3e31e88bf42310e41d17630

memory/3784-197-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

memory/3784-198-0x0000000070680000-0x00000000709D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2124-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2556-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2556-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2696-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2124-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2696-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2124-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2696-234-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2124-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-256-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2124-259-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 12:39

Reported

2024-05-16 12:42

Platform

win11-20240426-en

Max time kernel

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5104 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5104 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5104 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\system32\cmd.exe
PID 3316 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\system32\cmd.exe
PID 5084 wrote to memory of 1192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5084 wrote to memory of 1192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3316 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3316 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe
PID 3316 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe
PID 3316 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe C:\Windows\rss\csrss.exe

Processes

C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe

"C:\Users\Admin\AppData\Local\Temp\95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

Network

N/A

Files

memory/5104-1-0x0000000002A20000-0x0000000002E24000-memory.dmp

memory/5104-2-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/5104-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3004-4-0x000000007449E000-0x000000007449F000-memory.dmp

memory/3004-5-0x0000000002B30000-0x0000000002B66000-memory.dmp

memory/3004-6-0x0000000005360000-0x000000000598A000-memory.dmp

memory/3004-7-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/3004-8-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/3004-9-0x0000000005990000-0x00000000059B2000-memory.dmp

memory/3004-11-0x0000000005AA0000-0x0000000005B06000-memory.dmp

memory/3004-10-0x0000000005A30000-0x0000000005A96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkcb0yp1.5a1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3004-20-0x0000000005B10000-0x0000000005E67000-memory.dmp

memory/3004-21-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

memory/3004-22-0x0000000006020000-0x000000000606C000-memory.dmp

memory/3004-23-0x0000000006410000-0x0000000006456000-memory.dmp

memory/3004-25-0x0000000070700000-0x000000007074C000-memory.dmp

memory/3004-26-0x0000000070880000-0x0000000070BD7000-memory.dmp

memory/3004-35-0x0000000007440000-0x000000000745E000-memory.dmp

memory/3004-37-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/3004-36-0x0000000007460000-0x0000000007504000-memory.dmp

memory/3004-24-0x00000000073E0000-0x0000000007414000-memory.dmp

memory/3004-38-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/3004-39-0x0000000007BD0000-0x000000000824A000-memory.dmp

memory/3004-40-0x0000000007580000-0x000000000759A000-memory.dmp

memory/3004-41-0x00000000075C0000-0x00000000075CA000-memory.dmp

memory/3004-42-0x00000000076D0000-0x0000000007766000-memory.dmp

memory/3004-43-0x00000000075E0000-0x00000000075F1000-memory.dmp

memory/3004-44-0x0000000007630000-0x000000000763E000-memory.dmp

memory/3004-45-0x0000000007640000-0x0000000007655000-memory.dmp

memory/3004-46-0x0000000007690000-0x00000000076AA000-memory.dmp

memory/3004-47-0x00000000076B0000-0x00000000076B8000-memory.dmp

memory/3004-50-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/3316-52-0x0000000002A40000-0x0000000002E42000-memory.dmp

memory/2280-62-0x0000000070880000-0x0000000070BD7000-memory.dmp

memory/2280-61-0x0000000070700000-0x000000007074C000-memory.dmp

memory/2280-71-0x0000000007500000-0x00000000075A4000-memory.dmp

memory/2280-72-0x0000000007810000-0x0000000007821000-memory.dmp

memory/2280-73-0x0000000007860000-0x0000000007875000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 28acbd7a0b571467e295018381333868
SHA1 fb0b599a074c801914331e8277fca37c1e38ae8e
SHA256 0b367a5d21e56464c178ba89303ae05d9c829c81f995c2749902195c8341a1b9
SHA512 cc26fb71eca6992533dc71d3fc9f0b40df335d7d1b057e1f48703bb845b4cf38994569e1e7fa0eab1c246793c1a46342c4b9899fa3c9ca9aa79219afc6c1d682

memory/236-86-0x0000000070700000-0x000000007074C000-memory.dmp

memory/236-87-0x0000000070880000-0x0000000070BD7000-memory.dmp

memory/5104-96-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/5104-98-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/5104-97-0x0000000002A20000-0x0000000002E24000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c951c79a2ae10d7a0752916e2070186e
SHA1 2684429dfa2a749e98fe257f32260e354de1b1b1
SHA256 1a54805b48878d93a59f69e287c54d6f35d091515531dab1133b3659f189fdf5
SHA512 eda92de22080f888f90459272c29a4e8af59254b516d25020ee0a7918a9b610bf4330921f4fcc886292b57a832101cfa6442554ecf30dd50544be12bc89af617

memory/2864-109-0x0000000070700000-0x000000007074C000-memory.dmp

memory/2864-110-0x0000000070880000-0x0000000070BD7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 f3f1ea24c7557fd69b44b32d848b7aa6
SHA1 f18c7bcbb3231c8147bb799f2e8d1b46bcf30acb
SHA256 95d1a8a93f18e1da9b7dc25215409c2c7244cef17a9c7ab5c7bfa5c4cb7611c1
SHA512 7b32346d7bb6fe4465b611e3b615a9a9061d767c4fe67136f988902f0a8e6d694a0d5e2459719387345f8704ac39b6807ae7e58921011c9add028633bc23a710