glupteba | b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Size

4.1MB
MD5

f447c4d7756fa554f3d830aa62fdd6e7
SHA1

f07117ec1e991ddf0fe0cc00b4558b3ab9ec6297
SHA256

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8
SHA512

512ebbe70c6bc7eb17f86f3b7f1c885959afe3dc2e720e3f69ac614db2180fe1d023ede260241f1342f12dbaa6ee3cb82de580e1d9966fd12e93356cba363f5e
SSDEEP

98304:UX33DbWGkLHuFK+TwQmBC6reQ4TTNXYvI8KgvjrB0rf:UXPWAwQyCdJYw8Kggf

Score

10^/10

glupteba discovery dropper evasion execution loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2660-2-0x00000000049E0000-0x00000000052CB000-memory.dmp	family_glupteba
behavioral2/memory/2660-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2660-63-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/2660-78-0x00000000049E0000-0x00000000052CB000-memory.dmp	family_glupteba
behavioral2/memory/2660-121-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5052-120-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/5052-194-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-202-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-213-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-216-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-219-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-224-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-228-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-232-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-236-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-239-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-244-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-248-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4260-252-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4952 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4260 csrss.exe
3264 injector.exe
1788 windefender.exe
3860 windefender.exe

pid	process
4952	netsh.exe

pid	process
4260	csrss.exe
3264	injector.exe
1788	windefender.exe
3860	windefender.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/1788-208-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3860-210-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1788-211-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3860-217-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3860-225-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe

Drops file in Windows directory 4 IoCs

Processes:

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
File created	C:\Windows\rss\csrss.exe	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4252 sc.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

3152 powershell.exe
4164 powershell.exe
2056 powershell.exe
3496 powershell.exe
1256 powershell.exe
4132 powershell.exe
5096 powershell.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4576 schtasks.exe
2684 schtasks.exe

pid	process
4252	sc.exe

pid	process
3152	powershell.exe
4164	powershell.exe
2056	powershell.exe
3496	powershell.exe
1256	powershell.exe
4132	powershell.exe
5096	powershell.exe

pid	process
4576	schtasks.exe
2684	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-571 = "China Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeb11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exepowershell.exeb11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4132	powershell.exe
4132	powershell.exe
2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5096	powershell.exe
5096	powershell.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
3152	powershell.exe
3152	powershell.exe
4164	powershell.exe
4164	powershell.exe
2056	powershell.exe
2056	powershell.exe
3496	powershell.exe
3496	powershell.exe
1256	powershell.exe
1256	powershell.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
4260	csrss.exe
4260	csrss.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
4260	csrss.exe
4260	csrss.exe
3264	injector.exe
3264	injector.exe
4260	csrss.exe
4260	csrss.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe
3264	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exeb11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Token: SeImpersonatePrivilege	2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeSystemEnvironmentPrivilege	4260	csrss.exe
Token: SeSecurityPrivilege	4252	sc.exe
Token: SeSecurityPrivilege	4252	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exeb11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 2660 wrote to memory of 4132	2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 2660 wrote to memory of 4132	2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 2660 wrote to memory of 4132	2660	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 5096	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 5096	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 5096	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 4648	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	cmd.exe
PID 5052 wrote to memory of 4648	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	cmd.exe
PID 4648 wrote to memory of 4952	4648	cmd.exe	netsh.exe
PID 4648 wrote to memory of 4952	4648	cmd.exe	netsh.exe
PID 5052 wrote to memory of 3152	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 3152	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 3152	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 4164	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 4164	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 4164	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	powershell.exe
PID 5052 wrote to memory of 4260	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	csrss.exe
PID 5052 wrote to memory of 4260	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	csrss.exe
PID 5052 wrote to memory of 4260	5052	b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe	csrss.exe
PID 4260 wrote to memory of 2056	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 2056	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 2056	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 3496	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 3496	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 3496	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 1256	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 1256	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 1256	4260	csrss.exe	powershell.exe
PID 4260 wrote to memory of 3264	4260	csrss.exe	injector.exe
PID 4260 wrote to memory of 3264	4260	csrss.exe	injector.exe
PID 1788 wrote to memory of 2408	1788	windefender.exe	cmd.exe
PID 1788 wrote to memory of 2408	1788	windefender.exe	cmd.exe
PID 1788 wrote to memory of 2408	1788	windefender.exe	cmd.exe
PID 2408 wrote to memory of 4252	2408	cmd.exe	sc.exe
PID 2408 wrote to memory of 4252	2408	cmd.exe	sc.exe
PID 2408 wrote to memory of 4252	2408	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
"C:\Users\Admin\AppData\Local\Temp\b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Users\Admin\AppData\Local\Temp\b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe
"C:\Users\Admin\AppData\Local\Temp\b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4576

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:3600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3264

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2684

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzcurwn0.m4i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3c3f811d844fbda0d7a3d3b7ab1254d2

SHA1
376bc3244cdef0e1a032e3c6beb63d8b059a3ac9

SHA256
1fbfae45d063193663e22ba03ad6f848e703a42ca48d1aaa7de309dfb34a6ac5

SHA512
49b0a9c108208a39a13d4321ba644d1d3f195a156215e33500dfab5d0acd24f41b0aebf22fc48e820bbcccec1f0ef8abd115de24eef105762ceae7d929d41dcd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1ee5b3eb19cfb28c11cac6d76b2beccb

SHA1
bc65547a53ce32425f10492a9cad0bedc88d8195

SHA256
2f441c2b9731b0454be660772f2bfec9e48041dd1282e5e97cd9288603330eac

SHA512
ff2b272f2af20a343aaee4507d22ad3ce155c81985190c9c0655367bedf95b6c2b57274c9a6aef7e5757cfe60cde39b24ba641443f85d99337e387bc8680bb1f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
42cea364b646dd95a6ce41676eea7729

SHA1
b0e223adbc9127c66b79383e9ccf608600877de3

SHA256
843e7867c690d3752b3cdec403c37a9bd9f4a4add1df803c006bafa75f1bae14

SHA512
c6217328f4909f0adcebd182578405d3c287ef873b071030efa11e980947ff20a9a01b6c5c1db7923fe0f13a4a7f571aa66f6f58277200b0f21ccb8752e2e08d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
8cd6c5e0a70c1ccb6c533175d73534b7

SHA1
8e9ab47f5615faa62968724aace4ebf223979397

SHA256
d9099fad0399da7f63a384090d716f0c628bd7cf2ec82779f839a0f9768eb871

SHA512
6b6b4ad256cbfda4b9f232f812710cf51bd4bac290481948b32140110f7aeb696dfdec7b9f68a4169d169a0f36d085cc8e53818b6bf8ccf7a16435d060921f66

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ccc96a7ffd5f68ff5796af95f0b03f3a

SHA1
b99dd273473aa97456744ac22a2c9f9f9560b4a1

SHA256
7515c400ad3000c174d60e4557613f7f94bd27f28a330e4e6dd5bcf2bc4cf728

SHA512
7167b9c19e9ce5f054076c9dbacc7c546fefeccfd5bc12e28dbe0d1b6067b9341f47f59253f469bb02511a06bd2d666d6877b840994898c17456a698887e4fae

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
f447c4d7756fa554f3d830aa62fdd6e7

SHA1
f07117ec1e991ddf0fe0cc00b4558b3ab9ec6297

SHA256
b11e8b3fb9730767d6da7b99645c11e577afd21cc02fb17f1a53f60216c01bf8

SHA512
512ebbe70c6bc7eb17f86f3b7f1c885959afe3dc2e720e3f69ac614db2180fe1d023ede260241f1342f12dbaa6ee3cb82de580e1d9966fd12e93356cba363f5e

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1256-184-0x0000000070FE0000-0x000000007102C000-memory.dmp

Filesize
304KB

Download
memory/1256-185-0x0000000071260000-0x00000000715B7000-memory.dmp

Filesize
3.3MB

Download
memory/1788-208-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1788-211-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2056-139-0x0000000071240000-0x0000000071597000-memory.dmp

Filesize
3.3MB

Download
memory/2056-138-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/2056-136-0x0000000005500000-0x0000000005857000-memory.dmp

Filesize
3.3MB

Download
memory/2660-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2660-63-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/2660-1-0x00000000045E0000-0x00000000049E0000-memory.dmp

Filesize
4.0MB

Download
memory/2660-121-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2660-2-0x00000000049E0000-0x00000000052CB000-memory.dmp

Filesize
8.9MB

Download
memory/2660-78-0x00000000049E0000-0x00000000052CB000-memory.dmp

Filesize
8.9MB

Download
memory/2660-77-0x00000000045E0000-0x00000000049E0000-memory.dmp

Filesize
4.0MB

Download
memory/3152-89-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/3152-90-0x0000000071310000-0x0000000071667000-memory.dmp

Filesize
3.3MB

Download
memory/3496-173-0x0000000005990000-0x00000000059A5000-memory.dmp

Filesize
84KB

Download
memory/3496-172-0x0000000007170000-0x0000000007181000-memory.dmp

Filesize
68KB

Download
memory/3496-171-0x0000000006DC0000-0x0000000006E64000-memory.dmp

Filesize
656KB

Download
memory/3496-162-0x00000000711F0000-0x0000000071547000-memory.dmp

Filesize
3.3MB

Download
memory/3496-161-0x0000000070FE0000-0x000000007102C000-memory.dmp

Filesize
304KB

Download
memory/3496-160-0x00000000060F0000-0x000000000613C000-memory.dmp

Filesize
304KB

Download
memory/3496-158-0x0000000005610000-0x0000000005967000-memory.dmp

Filesize
3.3MB

Download
memory/3860-225-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3860-217-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3860-210-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4132-21-0x0000000006840000-0x000000000685E000-memory.dmp

Filesize
120KB

Download
memory/4132-44-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

Filesize
56KB

Download
memory/4132-42-0x0000000007F50000-0x0000000007FE6000-memory.dmp

Filesize
600KB

Download
memory/4132-43-0x0000000007E60000-0x0000000007E71000-memory.dmp

Filesize
68KB

Download
memory/4132-40-0x0000000007E00000-0x0000000007E1A000-memory.dmp

Filesize
104KB

Download
memory/4132-36-0x0000000007CB0000-0x0000000007CCE000-memory.dmp

Filesize
120KB

Download
memory/4132-37-0x0000000007CD0000-0x0000000007D74000-memory.dmp

Filesize
656KB

Download
memory/4132-38-0x0000000074E50000-0x0000000075601000-memory.dmp

Filesize
7.7MB

Download
memory/4132-27-0x0000000071310000-0x0000000071667000-memory.dmp

Filesize
3.3MB

Download
memory/4132-4-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

Filesize
4KB

Download
memory/4132-39-0x0000000008440000-0x0000000008ABA000-memory.dmp

Filesize
6.5MB

Download
memory/4132-25-0x0000000074E50000-0x0000000075601000-memory.dmp

Filesize
7.7MB

Download
memory/4132-5-0x0000000005380000-0x00000000053B6000-memory.dmp

Filesize
216KB

Download
memory/4132-6-0x0000000005A50000-0x000000000607A000-memory.dmp

Filesize
6.2MB

Download
memory/4132-26-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/4132-7-0x0000000074E50000-0x0000000075601000-memory.dmp

Filesize
7.7MB

Download
memory/4132-24-0x0000000007A70000-0x0000000007AA4000-memory.dmp

Filesize
208KB

Download
memory/4132-23-0x0000000006DB0000-0x0000000006DF6000-memory.dmp

Filesize
280KB

Download
memory/4132-22-0x0000000006870000-0x00000000068BC000-memory.dmp

Filesize
304KB

Download
memory/4132-41-0x0000000007E40000-0x0000000007E4A000-memory.dmp

Filesize
40KB

Download
memory/4132-20-0x0000000006390000-0x00000000066E7000-memory.dmp

Filesize
3.3MB

Download
memory/4132-8-0x0000000074E50000-0x0000000075601000-memory.dmp

Filesize
7.7MB

Download
memory/4132-11-0x0000000006320000-0x0000000006386000-memory.dmp

Filesize
408KB

Download
memory/4132-9-0x00000000059B0000-0x00000000059D2000-memory.dmp

Filesize
136KB

Download
memory/4132-10-0x0000000006180000-0x00000000061E6000-memory.dmp

Filesize
408KB

Download
memory/4132-50-0x0000000074E50000-0x0000000075601000-memory.dmp

Filesize
7.7MB

Download
memory/4132-47-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

Filesize
32KB

Download
memory/4132-46-0x0000000007F10000-0x0000000007F2A000-memory.dmp

Filesize
104KB

Download
memory/4132-45-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

Filesize
84KB

Download
memory/4164-110-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/4164-108-0x0000000006090000-0x00000000063E7000-memory.dmp

Filesize
3.3MB

Download
memory/4164-111-0x0000000071260000-0x00000000715B7000-memory.dmp

Filesize
3.3MB

Download
memory/4260-213-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-228-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-202-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-252-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-248-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-244-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-239-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-236-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-232-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-216-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-219-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4260-224-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/5052-120-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/5052-194-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/5096-73-0x0000000007080000-0x0000000007091000-memory.dmp

Filesize
68KB

Download
memory/5096-74-0x00000000070D0000-0x00000000070E5000-memory.dmp

Filesize
84KB

Download
memory/5096-60-0x0000000005620000-0x0000000005977000-memory.dmp

Filesize
3.3MB

Download
memory/5096-72-0x0000000006D70000-0x0000000006E14000-memory.dmp

Filesize
656KB

Download
memory/5096-61-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/5096-62-0x00000000712D0000-0x0000000071627000-memory.dmp

Filesize
3.3MB

Download