glupteba | 237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Size

4.1MB
MD5

05af924f1c11770af4b33ac7fb4998ff
SHA1

073fc0d6b1f46cf1dd160dff3a3497dbbcfa5ad2
SHA256

237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad
SHA512

1d5af6c07cd0c08f85dedda1c4a5ff4eb1daa4e024790617f887140219494877c03a77aade52395b7dc5d49956d00adcc77194c77873216b3f3147c6d5f0d91e
SSDEEP

98304:nHv+XyilWYyP9zZxACZeFw7DlvffePBhTqa:PFiEYyP9zPaw7Dlvf0Pj

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 15 IoCs

resource	yara_rule
behavioral1/memory/384-2-0x0000000002F20000-0x000000000380B000-memory.dmp	family_glupteba
behavioral1/memory/384-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/384-25-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/384-58-0x0000000002F20000-0x000000000380B000-memory.dmp	family_glupteba
behavioral1/memory/4624-59-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/384-60-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4624-88-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4624-123-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4624-155-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-256-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-299-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-323-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-353-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-401-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1064-406-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1380	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
1064	csrss.exe
1204	injector.exe
3088	tor.exe
1352	windefender.exe
4980	windefender.exe
2336	f801950a962ddba14caaa44bf084b55c.exe

Loads dropped DLL 9 IoCs

pid	Process
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe
3088	tor.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000022e8d-281.dat	upx
behavioral1/files/0x0007000000022e8d-291.dat	upx
behavioral1/files/0x0007000000022e8d-310.dat	upx
behavioral1/memory/1352-312-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4980-344-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x000f000000022d50-400.dat	upx
behavioral1/memory/4980-402-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x000f000000022d50-404.dat	upx
behavioral1/memory/4980-405-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2336-420-0x0000000000400000-0x0000000000C25000-memory.dmp	upx
behavioral1/memory/2336-431-0x0000000000400000-0x0000000000C25000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2952	sc.exe
2900	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2668	schtasks.exe
4468	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
444	powershell.exe
444	powershell.exe
384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1064	csrss.exe
1064	csrss.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1064	csrss.exe
1064	csrss.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1064	csrss.exe
1064	csrss.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1064	csrss.exe
1064	csrss.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe
1204	injector.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Token: SeImpersonatePrivilege	384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	1064	csrss.exe
Token: SeSecurityPrivilege	2952	sc.exe
Token: SeSecurityPrivilege	2952	sc.exe
Token: SeSecurityPrivilege	2900	sc.exe
Token: SeSecurityPrivilege	2900	sc.exe
Token: SeDebugPrivilege	4152	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 444	384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	95
PID 384 wrote to memory of 444	384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	95
PID 384 wrote to memory of 444	384	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	95
PID 4624 wrote to memory of 4384	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	102
PID 4624 wrote to memory of 4384	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	102
PID 4624 wrote to memory of 4384	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	102
PID 4624 wrote to memory of 5020	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	104
PID 4624 wrote to memory of 5020	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	104
PID 5020 wrote to memory of 1380	5020	cmd.exe	106
PID 5020 wrote to memory of 1380	5020	cmd.exe	106
PID 4624 wrote to memory of 4780	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	108
PID 4624 wrote to memory of 4780	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	108
PID 4624 wrote to memory of 4780	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	108
PID 4624 wrote to memory of 1500	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	111
PID 4624 wrote to memory of 1500	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	111
PID 4624 wrote to memory of 1500	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	111
PID 4624 wrote to memory of 1064	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	113
PID 4624 wrote to memory of 1064	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	113
PID 4624 wrote to memory of 1064	4624	237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe	113
PID 1064 wrote to memory of 4288	1064	csrss.exe	114
PID 1064 wrote to memory of 4288	1064	csrss.exe	114
PID 1064 wrote to memory of 4288	1064	csrss.exe	114
PID 1064 wrote to memory of 1280	1064	csrss.exe	120
PID 1064 wrote to memory of 1280	1064	csrss.exe	120
PID 1064 wrote to memory of 1280	1064	csrss.exe	120
PID 1064 wrote to memory of 4868	1064	csrss.exe	122
PID 1064 wrote to memory of 4868	1064	csrss.exe	122
PID 1064 wrote to memory of 4868	1064	csrss.exe	122
PID 1064 wrote to memory of 1204	1064	csrss.exe	126
PID 1064 wrote to memory of 1204	1064	csrss.exe	126
PID 1064 wrote to memory of 1796	1064	csrss.exe	137
PID 1064 wrote to memory of 1796	1064	csrss.exe	137
PID 1064 wrote to memory of 1796	1064	csrss.exe	137
PID 1796 wrote to memory of 2952	1796	cmd.exe	139
PID 1796 wrote to memory of 2952	1796	cmd.exe	139
PID 1796 wrote to memory of 2952	1796	cmd.exe	139
PID 1352 wrote to memory of 2396	1352	windefender.exe	140
PID 1352 wrote to memory of 2396	1352	windefender.exe	140
PID 1352 wrote to memory of 2396	1352	windefender.exe	140
PID 2396 wrote to memory of 2900	2396	cmd.exe	141
PID 2396 wrote to memory of 2900	2396	cmd.exe	141
PID 2396 wrote to memory of 2900	2396	cmd.exe	141
PID 1064 wrote to memory of 4152	1064	csrss.exe	144
PID 1064 wrote to memory of 4152	1064	csrss.exe	144
PID 1064 wrote to memory of 4152	1064	csrss.exe	144
PID 1064 wrote to memory of 2336	1064	csrss.exe	146
PID 1064 wrote to memory of 2336	1064	csrss.exe	146
PID 1064 wrote to memory of 2336	1064	csrss.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
"C:\Users\Admin\AppData\Local\Temp\237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Users\Admin\AppData\Local\Temp\237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe
  "C:\Users\Admin\AppData\Local\Temp\237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4288
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2668
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1280
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1204
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4468
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
      4⤵
      Executes dropped EXE
      PID:2336
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "csrss" /f
        5⤵
        
        PID:3344
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn "ScheduledUpdate" /f
        5⤵
        
        PID:2432

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3088

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdpawiba.q3q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Filesize
3.2MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

Filesize
99KB

MD5
09031a062610d77d685c9934318b4170

SHA1
880f744184e7774f3d14c1bb857e21cc7fe89a6d

SHA256
778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd

SHA512
9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-certs

Filesize
13KB

MD5
65ca2aef894b2297a097c1caadcb3f3e

SHA1
df68c4b14266fd6773e05fd6eba60a30e7ad45ae

SHA256
2c373150a8755a644d5879d9b37621ff2e159d35ef01c10e3aa82f143410883d

SHA512
2cfc35217fc483c79c2a1c2dbc0f7a7dee87f1c5852481e358ed215ba19c371e045d39eca43d1acc8e602b7d2923124ab350c0740a195f9c5d542740aaa4ac84

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus

Filesize
2.9MB

MD5
bd0c8fdb9e1bece6ff959270017c57d2

SHA1
e37a70946a955202f1e2825fe36f94967496f6e4

SHA256
98c3bb8ce968f5f20c35ae97eb04a49e417c3887899af95ec1d1e3e32cb55aad

SHA512
9fda5909a76d1d188bf937f17fcc25fcaf9994c0d1d87547f87955e0a15dfe378fcb34deb6505a5925c135b7e418c964a4a720de433ef8393a6d56ff1298fb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdesc-consensus.tmp

Filesize
2.9MB

MD5
bd0c8fdb9e1bece6ff959270017c57d2

SHA1
e37a70946a955202f1e2825fe36f94967496f6e4

SHA256
98c3bb8ce968f5f20c35ae97eb04a49e417c3887899af95ec1d1e3e32cb55aad

SHA512
9fda5909a76d1d188bf937f17fcc25fcaf9994c0d1d87547f87955e0a15dfe378fcb34deb6505a5925c135b7e418c964a4a720de433ef8393a6d56ff1298fb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

Filesize
5.8MB

MD5
fa297dcbd482a568dc8ef43e54dea9b2

SHA1
b2effe8aa6df319aca2aa630330d53268251dd56

SHA256
eec2094be56e2aabc458520435b223f854217b30baa754341b5fec46697c8d76

SHA512
937caa2af0d1956867f36793c541d9c9e47e53fa5c4a54d18a24b0d7c2d4ba14a0df3d59600389b806df0183a3ad913d6c3592036ba4f0fa70b886ca66a4edbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\cached-microdescs.new

Filesize
13.4MB

MD5
db9953174ef3777db21daa8acf5e9f78

SHA1
ccb5498b7f58f8d3d9782ee5780c39d76b14b854

SHA256
4dfebc1a248d5619fb7b494948908cfb168d7245eb829612e48769ccf5d08457

SHA512
774bf29696cf08386d8191dc62e6dd43384d8dd5a9a63f3ae0c79810e271c9d8daf7e4fc39fdddb860a82c6828dcfb0d58c40d23f13f96104a05f70fe787b7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip

Filesize
3.8MB

MD5
c72911dec6ae8c4bc62bb2a6a21ba85b

SHA1
0ae7077313a53103c2b32100d74aafc04216289d

SHA256
7e777efc194ea9788171636085b19875d19397d3249fbb88136534037a3dc38f

SHA512
99dc9761ad69f5508d96a2362b930728d451f5ddcf7bb1e210ec5b0f14ee00ee71efaaab150ffa16a2f92fbbb1e2a6b5cd92d51721996df7ac794491c441c304

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\geoip6

Filesize
5.6MB

MD5
ed2f9b19dd1584d7e26f5ba460ef2fbf

SHA1
dcbf1789bf1eeb03276b830cb2ab92bcf779d97f

SHA256
f11bd1d7546cad00b6db0a1594f3ac1daf9f541004fd7efb5414e068693d6add

SHA512
dcfc780d1e34968390969b64ea2091b630c8eec94ac4724a4103a003a2f31545c3791a39f514517153538b4d3f5c50b6bfba74cc9cf8c0b1b5daba0a4849c856

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libcrypto-1_1.dll

Filesize
3.5MB

MD5
b7c32c8e7d21aa9b79470037227eba43

SHA1
38d719b10ca035cee65162c1a44e2c62123d41b4

SHA256
99b4042a858a9e437917c8256692e9ba161b87054ccf5e22538e86bb35c34f23

SHA512
d85345380b9605c8484e11873218aa4eaeea573ca51eedada6d0518695a2b184bb22faf7c5e3d88330935774ced17e9d80c577b06603aa1ca6dab748b0bd15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

Filesize
876KB

MD5
736443b08b5a52b6958f001e8200be71

SHA1
e56ddc8476aef0d3482c99c5bfaf0f57458b2576

SHA256
da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

SHA512
9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent-2-1-7.dll

Filesize
876KB

MD5
736443b08b5a52b6958f001e8200be71

SHA1
e56ddc8476aef0d3482c99c5bfaf0f57458b2576

SHA256
da1f75b9ce5f47cb78a6930a50c08397ee4d9778302746340f4057fcd838dbf4

SHA512
9dfcdb1186b089e7961767d427de986ad8e5f7715b7592984349d0b8e7f02198137c83e8c79a096a7475ad9f4695f52539fa08fa65912860ddf0a85515a7cda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent_core-2-1-7.dll

Filesize
701KB

MD5
f1bcc8bd3200845993211eb807f33e56

SHA1
d25274e36e79d8e50a446b1144d8b6f2b2cf309b

SHA256
7cd199bbf3bfe19182c5eca3a080a7e93cec0d30cbd872a305c92bc9282a7399

SHA512
397ba6b995aebce54b95c7f3abd3c64ae2c5ab3d01fb38185f8fccad82cac335e2f0666fc47b73d3a3a4af9b5a5ce311e4963841616f4d38b03e1bc16355b5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libevent_extra-2-1-7.dll

Filesize
497KB

MD5
f963552b851fde3834405bb98bae0c36

SHA1
822c7d7988ac28aca080dbc9c26f98416f67124f

SHA256
36c66cfc6e9663bdd2cdc54a1253a8c26c837ca0bd8c52769b5820641c18d4c3

SHA512
b301df8740e07c1032e959e563842d568916f7165f72c459c0ffcbe1a717b0886be1d2ef8b992875392a09983ae9e35e7481b29c213a18ee15b335a9849cf39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

Filesize
668KB

MD5
36e1c3814bde3418ba3d38517954cb7c

SHA1
495e1ba5b0b442e70124d33daa6fea4e3e5931b0

SHA256
b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

SHA512
df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

Filesize
668KB

MD5
36e1c3814bde3418ba3d38517954cb7c

SHA1
495e1ba5b0b442e70124d33daa6fea4e3e5931b0

SHA256
b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

SHA512
df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libgcc_s_dw2-1.dll

Filesize
668KB

MD5
36e1c3814bde3418ba3d38517954cb7c

SHA1
495e1ba5b0b442e70124d33daa6fea4e3e5931b0

SHA256
b34edd252f46dd881e79cfd274777fe5e90943d511c8e002aeca0528d7f3b4b1

SHA512
df7b608c51a782ad5cdfd753577a3dcacf4e2515ac02ce9e35b3cbc543895862844e8adcaff983b1348884085cf7427c33a67acc5ce48fe656f5b2083d0813b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

Filesize
938KB

MD5
d92e59b71bf8a0d827597ed95b2eca42

SHA1
cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

SHA256
b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

SHA512
be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssl-1_1.dll

Filesize
938KB

MD5
d92e59b71bf8a0d827597ed95b2eca42

SHA1
cfc49ff29eddb7127fbed166a8a1e740ea3dfb9a

SHA256
b6ef5cb4c093431f3e73c53e66df33d08237ba46d457d119a2c4dcae582314e3

SHA512
be65e003a498e753b08912d697e9b4d8a28828581c17d1e8e20880372a81030ce18610eeff230c8880e68a831041075bb2ebffcf318d29ebf58bc856fac3df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

Filesize
95KB

MD5
7cdbaca31739500aefc06dd85a8558ff

SHA1
adc36ec6a3cdc7e57a1b706c820e382627f6cb90

SHA256
0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

SHA512
6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libssp-0.dll

Filesize
95KB

MD5
7cdbaca31739500aefc06dd85a8558ff

SHA1
adc36ec6a3cdc7e57a1b706c820e382627f6cb90

SHA256
0a1dee5dd5234971f7526f3d5f8b7e2cfdcb536e18debd51c985010fb504fbdb

SHA512
6df8ac9054f27ebbef9642ce79ff7ba836411ea0ed0bd04b3cfe724a336a91f665c2cc0b7a4bfc99a80786d1a6d361b971a7dbb7a298b919a1baa812541841ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

Filesize
301KB

MD5
07f4bbf18077231cb44750684dd8daf4

SHA1
8560627e9e05d6022abdfe7e576856e91ac90188

SHA256
4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

SHA512
04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\libwinpthread-1.dll

Filesize
301KB

MD5
07f4bbf18077231cb44750684dd8daf4

SHA1
8560627e9e05d6022abdfe7e576856e91ac90188

SHA256
4a146671b1fed4906799cb1cfc670753f1b1922793f5b40d5cf710befb287316

SHA512
04e31ad60e797cdbd1f3db36a8473139bbd1b763d2d67a160454b24b524e8bbc4d5784c62446a0f9d83b95dd518534ab4581d3a43a14146b17d0035ecc79c151

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\state

Filesize
3KB

MD5
b9e9337d5f93c1d5c976819c23a66fd3

SHA1
4d7f89f460cc694d97eccc99081863766e7bd845

SHA256
7f34c9bbfd26391b5ae6021f7f9ced15e38ccf38fcad126da587ae5bbede5925

SHA512
b2944ccdd605b01598ed59f96e8748949fc7910496cc20a1f16d53dbdd2a7f60507d0a171dba4d1bbc93ab938e048d1fc29373a583f0cfea03ccec9ccb4ecce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor-gencert.exe

Filesize
1.0MB

MD5
8a574c633eb3c8b7d209b5940ebf731b

SHA1
e835c5668ad1437cebdbd56bc7923c3683e8b9ad

SHA256
bfd8dd86a41bc05beea0f240c35e88bd42abada70eff4741717901d1b55bfb28

SHA512
085ee9d9c52fd5f6ff2095727d9e3b1d27c5b2d3ab54ca11149954a4b031296c9cf9c81457a2df8eba916336cdef4ea2bd39cf98d4ad19ab78e53ac85b6d6dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

Filesize
4.3MB

MD5
055ae7c584a7b012955bf5d874f30cfa

SHA1
f2b4d8c5307ff09607be929ec08fc2727bf03dcf

SHA256
d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

SHA512
910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe

Filesize
4.3MB

MD5
055ae7c584a7b012955bf5d874f30cfa

SHA1
f2b4d8c5307ff09607be929ec08fc2727bf03dcf

SHA256
d51b5bf807f6de3b5521b49b9a722592fb85aee1ea2f1c03bbb5255d62bfb9c8

SHA512
910bb0be7a3840bb37cb453ea066677a5327e272cfa0995f7a600bd4eb2e7c31685dcc0758c3b2cf07c7622fd45b2d4cdd3a4272cddaf9e97e2ffc48120646c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\unverified-microdesc-consensus

Filesize
2.9MB

MD5
bd0c8fdb9e1bece6ff959270017c57d2

SHA1
e37a70946a955202f1e2825fe36f94967496f6e4

SHA256
98c3bb8ce968f5f20c35ae97eb04a49e417c3887899af95ec1d1e3e32cb55aad

SHA512
9fda5909a76d1d188bf937f17fcc25fcaf9994c0d1d87547f87955e0a15dfe378fcb34deb6505a5925c135b7e418c964a4a720de433ef8393a6d56ff1298fb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

Filesize
135KB

MD5
f08b1f044c68770c190daf1eb1f3157e

SHA1
f94103a542459d60434f9ddb6b5f45b11eae2923

SHA256
1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

SHA512
0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\zlib1.dll

Filesize
135KB

MD5
f08b1f044c68770c190daf1eb1f3157e

SHA1
f94103a542459d60434f9ddb6b5f45b11eae2923

SHA256
1d0278386f8922bdf4808861e6e901541ad23cc6337bb022c78dc05915202f27

SHA512
0667416a7515cd845e96d2ad26ca676cffd2d1c9f0449ff05455e8cf6a7ab595d3f972785d051f45332c04f1c0b576726f645e3669122608a4f374e984ba161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt

Filesize
3KB

MD5
9700ebd1fcdb4febe9a0bd005bf87206

SHA1
47a5f6e88d5f4e2ac59dfd3304e25e8d4273dba4

SHA256
b55bb12cca970dd1bd6d414ad8478b3ce1b1899a65ea4885a5b74e3e5ac4bb9a

SHA512
1fcf71516dd19912d69dd1436333bb5857aac9396324694ee40a000e156e879e32673fa571127233dcfbd99112b939dfdd9abbe6a488b4a69e6ad9e9f5166b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc

Filesize
227B

MD5
17c2994d6a89cb7d277f1b3f0b49e5ed

SHA1
2a72ffc34cb2a7d7d3057f4725f2ac660a809158

SHA256
38ad4c6fb403fc2d5dc0dc83a165983a3fb426e0a850847fefc35e62a5ced67f

SHA512
d145ea667f70ed08b12d44228aea09cab637dd1acee131b919f22efdd4730b0c18daa0c83b196f5efa2082cf8f90bcd618b7c7efaab79ca5f0478ade0aca4728

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4c59ac6f9ff7d2ff4ba20f3401bb71f0

SHA1
a7f6625a22c5e6402f2c32b6676b2a22ff468b60

SHA256
b63188187647f8f2145dd2defd5345ebd2549b5f9f06c7bd7243e77d28bc8183

SHA512
8457cfa2c3c1aea632c8b2a47f090f68bc3421c9ac6bb9dba51484cdb6f04b938e8184d95a5d8cc6bf79ccf3e33a5ba985dba3a8e7710852311193f973d0be34

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
c80a7cd9dd0fa8e2cacee49385e46c87

SHA1
ff69a88505a50f9e1528861910b63730419dda61

SHA256
ad2166b3eb21e7120a7b107979e8bfa4dc473bc9e6fc7dfee8bd259d75d27f6a

SHA512
f01304fa5dee266a70f64e2559e5ac74b68a195fa0f3ead1e687d124873bd3d1cd978d8bdd58e36306944baf167950e17fd72abebceb767947f1292afffe8672

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e33cfca9cba4186082c93c4f942b1edd

SHA1
f9ae7597ee48b1e7d3e603377c32cd8a1b49c304

SHA256
03df83a0198d1ff985c1d59fa987e604a65d563a14e1a4f46b77314c2d74bd43

SHA512
6509dd6611bbb405e999a3393b942bdda50ce788d4b0ab92e67ea8c60d841f41775ddefb93ae6726934c8e2b88078094e118b7288e471427267dd1872c63f29d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
42afbef342c9d9d997182b35b3839b41

SHA1
05b3097a6b1733a8d56ce515b121f7c179722a2c

SHA256
2d9e3caf48226d6a652a2770280cb96ddbad87d4b9b893231e90c623ae7ff503

SHA512
eb6d16118f8c8721620f313060d50106592e64b212d725de29241970832f100d26e0947a394658be85a35ef41855036e2f7258827f403024f952dfebff7301b7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
511fd821eae21e620879dd2a9f8e9655

SHA1
a994a63a169123bd4b0344f91f6cb66bb88c65d4

SHA256
6dfb8876d35e9312d0d97cde31fbe271abcd6e6f4b7e14c9408d348a10cc2a99

SHA512
6d1ac5ec70d74ee3ff7e2be94c35682487ec0fc7533c3254896574dc6919a87139a751fdde85c4acf18caa79e951242475b63f21e8d6623187a73cf44c115826

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
56b0faa7416eba074fa180e915f1ee62

SHA1
c1a101ce7a87911bd959c71fd80c1f1f14eab08f

SHA256
38fccac6d0fceb6b38d35828b9ad61eb0c4dac0c20fe9343b45ab728ee1b5b71

SHA512
7a26c8b0d5cac9a19818bb5e4052be06cf63bf85f6647f4fe209f1064dac23b2196b1db138af85c48c37274a3ad1bd551c2b2cf4fe204e9b21ab44274e5a4a48

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
05af924f1c11770af4b33ac7fb4998ff

SHA1
073fc0d6b1f46cf1dd160dff3a3497dbbcfa5ad2

SHA256
237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad

SHA512
1d5af6c07cd0c08f85dedda1c4a5ff4eb1daa4e024790617f887140219494877c03a77aade52395b7dc5d49956d00adcc77194c77873216b3f3147c6d5f0d91e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
05af924f1c11770af4b33ac7fb4998ff

SHA1
073fc0d6b1f46cf1dd160dff3a3497dbbcfa5ad2

SHA256
237a9fc5cc8f7db5b6add19731a2f79c463724c540c59066d53e82d9a4b7c9ad

SHA512
1d5af6c07cd0c08f85dedda1c4a5ff4eb1daa4e024790617f887140219494877c03a77aade52395b7dc5d49956d00adcc77194c77873216b3f3147c6d5f0d91e

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/384-60-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/384-2-0x0000000002F20000-0x000000000380B000-memory.dmp

Filesize
8.9MB

Download
memory/384-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/384-58-0x0000000002F20000-0x000000000380B000-memory.dmp

Filesize
8.9MB

Download
memory/384-56-0x0000000002B10000-0x0000000002F17000-memory.dmp

Filesize
4.0MB

Download
memory/384-1-0x0000000002B10000-0x0000000002F17000-memory.dmp

Filesize
4.0MB

Download
memory/384-25-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/444-54-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/444-51-0x00000000075D0000-0x00000000075D8000-memory.dmp

Filesize
32KB

Download
memory/444-4-0x0000000002860000-0x0000000002896000-memory.dmp

Filesize
216KB

Download
memory/444-5-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/444-7-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/444-6-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/444-8-0x00000000050B0000-0x00000000056D8000-memory.dmp

Filesize
6.2MB

Download
memory/444-9-0x0000000004E90000-0x0000000004EB2000-memory.dmp

Filesize
136KB

Download
memory/444-10-0x0000000005030000-0x0000000005096000-memory.dmp

Filesize
408KB

Download
memory/444-11-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/444-21-0x0000000005810000-0x0000000005B64000-memory.dmp

Filesize
3.3MB

Download
memory/444-22-0x0000000005E70000-0x0000000005E8E000-memory.dmp

Filesize
120KB

Download
memory/444-23-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

Filesize
304KB

Download
memory/444-24-0x0000000006280000-0x00000000062C4000-memory.dmp

Filesize
272KB

Download
memory/444-26-0x0000000004A70000-0x0000000004A80000-memory.dmp

Filesize
64KB

Download
memory/444-27-0x00000000071B0000-0x0000000007226000-memory.dmp

Filesize
472KB

Download
memory/444-28-0x00000000078B0000-0x0000000007F2A000-memory.dmp

Filesize
6.5MB

Download
memory/444-29-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/444-30-0x000000007EEB0000-0x000000007EEC0000-memory.dmp

Filesize
64KB

Download
memory/444-31-0x00000000073F0000-0x0000000007422000-memory.dmp

Filesize
200KB

Download
memory/444-32-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/444-33-0x0000000070220000-0x0000000070574000-memory.dmp

Filesize
3.3MB

Download
memory/444-43-0x00000000073D0000-0x00000000073EE000-memory.dmp

Filesize
120KB

Download
memory/444-44-0x0000000007430000-0x00000000074D3000-memory.dmp

Filesize
652KB

Download
memory/444-45-0x0000000007520000-0x000000000752A000-memory.dmp

Filesize
40KB

Download
memory/444-46-0x00000000075E0000-0x0000000007676000-memory.dmp

Filesize
600KB

Download
memory/444-47-0x0000000007540000-0x0000000007551000-memory.dmp

Filesize
68KB

Download
memory/444-48-0x0000000007580000-0x000000000758E000-memory.dmp

Filesize
56KB

Download
memory/444-49-0x0000000007590000-0x00000000075A4000-memory.dmp

Filesize
80KB

Download
memory/444-50-0x0000000007680000-0x000000000769A000-memory.dmp

Filesize
104KB

Download
memory/1064-353-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1064-299-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1064-323-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1064-256-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1064-401-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1064-406-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1352-312-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1500-138-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/1500-136-0x0000000005DC0000-0x0000000006114000-memory.dmp

Filesize
3.3MB

Download
memory/1500-139-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/1500-126-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/1500-125-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/1500-140-0x0000000070200000-0x0000000070554000-memory.dmp

Filesize
3.3MB

Download
memory/1500-124-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/2336-420-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8.1MB

Download
memory/2336-431-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8.1MB

Download
memory/3088-329-0x0000000074860000-0x0000000074921000-memory.dmp

Filesize
772KB

Download
memory/3088-332-0x0000000074650000-0x00000000746F0000-memory.dmp

Filesize
640KB

Download
memory/3088-297-0x0000000074860000-0x0000000074921000-memory.dmp

Filesize
772KB

Download
memory/3088-411-0x0000000000860000-0x0000000000CAE000-memory.dmp

Filesize
4.3MB

Download
memory/3088-371-0x0000000000860000-0x0000000000CAE000-memory.dmp

Filesize
4.3MB

Download
memory/3088-300-0x0000000000860000-0x0000000000CAE000-memory.dmp

Filesize
4.3MB

Download
memory/3088-345-0x0000000000860000-0x0000000000CAE000-memory.dmp

Filesize
4.3MB

Download
memory/3088-298-0x0000000074740000-0x000000007476A000-memory.dmp

Filesize
168KB

Download
memory/3088-325-0x0000000000860000-0x0000000000CAE000-memory.dmp

Filesize
4.3MB

Download
memory/3088-326-0x0000000074840000-0x000000007485E000-memory.dmp

Filesize
120KB

Download
memory/3088-327-0x0000000074770000-0x0000000074832000-memory.dmp

Filesize
776KB

Download
memory/3088-334-0x0000000074340000-0x0000000074641000-memory.dmp

Filesize
3.0MB

Download
memory/3088-331-0x00000000746F0000-0x000000007473D000-memory.dmp

Filesize
308KB

Download
memory/4384-74-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/4384-61-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4384-89-0x0000000007350000-0x0000000007364000-memory.dmp

Filesize
80KB

Download
memory/4384-62-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/4384-63-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/4384-69-0x0000000005740000-0x0000000005A94000-memory.dmp

Filesize
3.3MB

Download
memory/4384-92-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4384-75-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/4384-87-0x00000000072E0000-0x00000000072F1000-memory.dmp

Filesize
68KB

Download
memory/4384-86-0x0000000006DD0000-0x0000000006E73000-memory.dmp

Filesize
652KB

Download
memory/4384-76-0x0000000070800000-0x0000000070B54000-memory.dmp

Filesize
3.3MB

Download
memory/4624-123-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4624-57-0x0000000002BB0000-0x0000000002FB3000-memory.dmp

Filesize
4.0MB

Download
memory/4624-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4624-155-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4624-88-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4624-109-0x0000000002BB0000-0x0000000002FB3000-memory.dmp

Filesize
4.0MB

Download
memory/4780-96-0x00000000022E0000-0x00000000022F0000-memory.dmp

Filesize
64KB

Download
memory/4780-95-0x00000000022E0000-0x00000000022F0000-memory.dmp

Filesize
64KB

Download
memory/4780-108-0x00000000022E0000-0x00000000022F0000-memory.dmp

Filesize
64KB

Download
memory/4780-94-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4780-122-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4780-111-0x0000000070800000-0x0000000070B54000-memory.dmp

Filesize
3.3MB

Download
memory/4780-110-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/4980-405-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4980-344-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4980-402-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download