glupteba | a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c

Analysis

max time kernel
91s
max time network
155s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
18/07/2023, 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Size

4.2MB
MD5

294af6fd13b3e6b2da02dba51f06a066
SHA1

cb43c58a55b0706b60fb02c6d0eb7c96c4de83cf
SHA256

a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c
SHA512

f4330a3245656acda6dd33af142c4ffc2a91c3b3a8a85a8534d9cb05168f2995408e366ccccc8f9f3e9fc2c71e928249558499127d3c9516dc8460f57565bda9
SSDEEP

98304:rl1biry4pKxJw74pmsb0eKjq9xslCxvihWXN0BZ8np:rOe48gPMw4slCx/d0j8p

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 17 IoCs

resource	yara_rule
behavioral1/memory/2216-122-0x0000000002EC0000-0x00000000037AB000-memory.dmp	family_glupteba
behavioral1/memory/2216-123-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2216-124-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2216-137-0x0000000002EC0000-0x00000000037AB000-memory.dmp	family_glupteba
behavioral1/memory/2216-140-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2216-279-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2216-427-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2836-430-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2836-448-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2836-672-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2836-702-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/2836-1169-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/4184-1173-0x0000000003400000-0x0000000003CEB000-memory.dmp	family_glupteba
behavioral1/memory/4184-1174-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/4184-1175-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/4184-1530-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/4184-1917-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2964	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4184	csrss.exe
4592	injector.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
File created	C:\Windows\rss\csrss.exe	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3824	schtasks.exe
2132	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
384	powershell.exe
384	powershell.exe
384	powershell.exe
2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
1340	powershell.exe
1340	powershell.exe
1340	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
1100	powershell.exe
1100	powershell.exe
1100	powershell.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4184	csrss.exe
4184	csrss.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4592	injector.exe
4184	csrss.exe
4184	csrss.exe
4592	injector.exe
4592	injector.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Token: SeImpersonatePrivilege	2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeSystemEnvironmentPrivilege	4184	csrss.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 384	2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	70
PID 2216 wrote to memory of 384	2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	70
PID 2216 wrote to memory of 384	2216	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	70
PID 2836 wrote to memory of 3716	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	75
PID 2836 wrote to memory of 3716	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	75
PID 2836 wrote to memory of 3716	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	75
PID 2836 wrote to memory of 4196	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	78
PID 2836 wrote to memory of 4196	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	78
PID 4196 wrote to memory of 2964	4196	cmd.exe	79
PID 4196 wrote to memory of 2964	4196	cmd.exe	79
PID 2836 wrote to memory of 3000	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	80
PID 2836 wrote to memory of 3000	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	80
PID 2836 wrote to memory of 3000	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	80
PID 2836 wrote to memory of 3972	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	82
PID 2836 wrote to memory of 3972	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	82
PID 2836 wrote to memory of 3972	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	82
PID 2836 wrote to memory of 4184	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	84
PID 2836 wrote to memory of 4184	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	84
PID 2836 wrote to memory of 4184	2836	a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe	84
PID 4184 wrote to memory of 1340	4184	csrss.exe	85
PID 4184 wrote to memory of 1340	4184	csrss.exe	85
PID 4184 wrote to memory of 1340	4184	csrss.exe	85
PID 4184 wrote to memory of 3560	4184	csrss.exe	92
PID 4184 wrote to memory of 3560	4184	csrss.exe	92
PID 4184 wrote to memory of 3560	4184	csrss.exe	92
PID 4184 wrote to memory of 1100	4184	csrss.exe	94
PID 4184 wrote to memory of 1100	4184	csrss.exe	94
PID 4184 wrote to memory of 1100	4184	csrss.exe	94
PID 4184 wrote to memory of 4592	4184	csrss.exe	96
PID 4184 wrote to memory of 4592	4184	csrss.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
"C:\Users\Admin\AppData\Local\Temp\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Users\Admin\AppData\Local\Temp\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe
  "C:\Users\Admin\AppData\Local\Temp\a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1340
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3824
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4592
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq1ew5jh.zvn.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d07e8ffc551e1cf7e23c007e3eb23fd8

SHA1
1e94cc6066b28a6bbe09ef585d4826bed8a45578

SHA256
f97ffed01083026e5e76a2fa93e5a81495df21898a2c1ad3d4616f23559d767f

SHA512
2baa83355727abb12e627dc1f7a11487378ece49cc8dd673c1dca1588078587de0f2dd2a6e1e2c09c2df9e7c89272b9a1a2352bd777b547e43ffbf33ceb4cdff

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
e4153d47378ba3a1870167dec316ebdc

SHA1
b9d84801143eb8e9ae16e96fea6d30ab6cd9eeb2

SHA256
5110c65a0fff3db6ad21f44b43d1d75c083598d94a5439f3255decb6428d8f11

SHA512
20563a1a75112d6e60d9491549418cbf640a921f43d5accfa862776dce5783119629e9bfc771c36fe69643eb4af054ffdd33ce610cdd9a4d7f62cbd4cd17870b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
24b43c83d8c4ab8719654c7a05fafb69

SHA1
8c347be7b1d0d3a1c17e550e260a63c1758454b8

SHA256
9e9398e99152b0fb3b9e70a9d2253734ef080e936c4f5682ef5e95f2e4173656

SHA512
80adb0b1197d0270aed8cdbc8d11e1ca04263d56f6fc387e8eeededeb76cbc9454b922584bbb57082eb9d1267c7b05b0f5a4935948f5a307b80767214f982ab9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
2227dfbed7b39d42cc68500424377845

SHA1
fc41f80d8fd3fd3dd72fb280e983ec98aab2a5a9

SHA256
04e22668ba6d59190adc0aa73589afa5e6f91df2981fc0a5d15e8ccce99deb14

SHA512
e129ae5fff4e3d0576a135f8877687ec26d0b94cc22f0690309598014a4bb26267cf35c06c03071af255b63ea05a6bff0f4da8bff4b734afaefa5d24fd72d78e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
882362da983ebbeb0762f75bb4fe1421

SHA1
1a4cb1ca1752229d24925bc3687cf7a538f4f31e

SHA256
16d803696a13a92078eda9b3e76762cce26755dc6ad0748e4f311de25be30cae

SHA512
c8dc99bef6e4477768d25b8c495100186d160707cb37699bf4eeec11f7b56d4816ec77b28174661dd814c23ff2c55b2689e4c3d8493e2d0c97efc5fe27254b44

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
294af6fd13b3e6b2da02dba51f06a066

SHA1
cb43c58a55b0706b60fb02c6d0eb7c96c4de83cf

SHA256
a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c

SHA512
f4330a3245656acda6dd33af142c4ffc2a91c3b3a8a85a8534d9cb05168f2995408e366ccccc8f9f3e9fc2c71e928249558499127d3c9516dc8460f57565bda9

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
294af6fd13b3e6b2da02dba51f06a066

SHA1
cb43c58a55b0706b60fb02c6d0eb7c96c4de83cf

SHA256
a7bcf7b23dfb77ebaf1d36db5e22974f19e5ad03384be1c99f29ccf4c7e9879c

SHA512
f4330a3245656acda6dd33af142c4ffc2a91c3b3a8a85a8534d9cb05168f2995408e366ccccc8f9f3e9fc2c71e928249558499127d3c9516dc8460f57565bda9

Download Submit
memory/384-197-0x000000007EDD0000-0x000000007EDE0000-memory.dmp

Filesize
64KB

Download
memory/384-206-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/384-136-0x00000000079C0000-0x0000000007D10000-memory.dmp

Filesize
3.3MB

Download
memory/384-130-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/384-138-0x0000000007240000-0x000000000725C000-memory.dmp

Filesize
112KB

Download
memory/384-139-0x0000000007D20000-0x0000000007D6B000-memory.dmp

Filesize
300KB

Download
memory/384-127-0x0000000000C80000-0x0000000000CB6000-memory.dmp

Filesize
216KB

Download
memory/384-134-0x0000000006F40000-0x0000000006FA6000-memory.dmp

Filesize
408KB

Download
memory/384-151-0x0000000008C90000-0x0000000008D06000-memory.dmp

Filesize
472KB

Download
memory/384-160-0x0000000008E00000-0x0000000008E3C000-memory.dmp

Filesize
240KB

Download
memory/384-131-0x0000000007290000-0x00000000078B8000-memory.dmp

Filesize
6.2MB

Download
memory/384-198-0x0000000009C70000-0x0000000009CA3000-memory.dmp

Filesize
204KB

Download
memory/384-199-0x0000000009C50000-0x0000000009C6E000-memory.dmp

Filesize
120KB

Download
memory/384-204-0x0000000009CB0000-0x0000000009D55000-memory.dmp

Filesize
660KB

Download
memory/384-205-0x00000000730B0000-0x000000007379E000-memory.dmp

Filesize
6.9MB

Download
memory/384-128-0x00000000730B0000-0x000000007379E000-memory.dmp

Filesize
6.9MB

Download
memory/384-207-0x0000000009EB0000-0x0000000009F44000-memory.dmp

Filesize
592KB

Download
memory/384-278-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/384-129-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/384-285-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/384-403-0x0000000008150000-0x000000000816A000-memory.dmp

Filesize
104KB

Download
memory/384-408-0x0000000008140000-0x0000000008148000-memory.dmp

Filesize
32KB

Download
memory/384-426-0x00000000730B0000-0x000000007379E000-memory.dmp

Filesize
6.9MB

Download
memory/384-135-0x0000000007060000-0x00000000070C6000-memory.dmp

Filesize
408KB

Download
memory/384-133-0x0000000006E20000-0x0000000006E42000-memory.dmp

Filesize
136KB

Download
memory/1340-1181-0x00000000080F0000-0x0000000008440000-memory.dmp

Filesize
3.3MB

Download
memory/1340-1180-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/1340-1179-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/1340-1183-0x0000000008810000-0x000000000885B000-memory.dmp

Filesize
300KB

Download
memory/1340-1178-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/1340-1203-0x000000007E7B0000-0x000000007E7C0000-memory.dmp

Filesize
64KB

Download
memory/2216-123-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2216-132-0x0000000002AC0000-0x0000000002EBC000-memory.dmp

Filesize
4.0MB

Download
memory/2216-124-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2216-137-0x0000000002EC0000-0x00000000037AB000-memory.dmp

Filesize
8.9MB

Download
memory/2216-140-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2216-122-0x0000000002EC0000-0x00000000037AB000-memory.dmp

Filesize
8.9MB

Download
memory/2216-121-0x0000000002AC0000-0x0000000002EBC000-memory.dmp

Filesize
4.0MB

Download
memory/2216-279-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2216-427-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-430-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-702-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-429-0x0000000002A40000-0x0000000002E46000-memory.dmp

Filesize
4.0MB

Download
memory/2836-448-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-672-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-1169-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2836-463-0x0000000002A40000-0x0000000002E46000-memory.dmp

Filesize
4.0MB

Download
memory/3000-685-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/3000-686-0x0000000007840000-0x0000000007B90000-memory.dmp

Filesize
3.3MB

Download
memory/3000-684-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/3000-711-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/3000-924-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-683-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3716-674-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3716-437-0x00000000082A0000-0x00000000082EB000-memory.dmp

Filesize
300KB

Download
memory/3716-433-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3716-434-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/3716-435-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/3716-436-0x0000000007C50000-0x0000000007FA0000-memory.dmp

Filesize
3.3MB

Download
memory/3716-457-0x000000007F130000-0x000000007F140000-memory.dmp

Filesize
64KB

Download
memory/3716-462-0x0000000009660000-0x0000000009705000-memory.dmp

Filesize
660KB

Download
memory/3716-679-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3972-927-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/3972-928-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download
memory/3972-952-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download
memory/3972-1165-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/4184-1202-0x0000000003000000-0x00000000033F9000-memory.dmp

Filesize
4.0MB

Download
memory/4184-1175-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4184-1530-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4184-1174-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4184-1173-0x0000000003400000-0x0000000003CEB000-memory.dmp

Filesize
8.9MB

Download
memory/4184-1172-0x0000000003000000-0x00000000033F9000-memory.dmp

Filesize
4.0MB

Download
memory/4184-1917-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download