glupteba | 24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda

Analysis

max time kernel
152s
max time network
156s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
22/09/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Size

4.1MB
MD5

3eb71040bc91b8c1fbb0568233fb9c14
SHA1

37cd96b56d9b89e6c7f5cdc4e614be9646a1909c
SHA256

24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda
SHA512

e226308f3f5611c208039f6103883e13952758c2a9952ab2eabd61e91bcf2266a1fa43d6dfa90120d70815dad1b844d6812ad76dfb57aeb7ea360efe9d149983
SSDEEP

98304:K1x3Q/VwwSYt94YcWJjACvETcteichLVrFLLHVmNx3/:QeHS0m1HCs4IVrZLHwNxv

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 22 IoCs

resource	yara_rule
behavioral1/memory/1936-1-0x0000000003030000-0x000000000391B000-memory.dmp	family_glupteba
behavioral1/memory/1936-2-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/1936-69-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/1936-70-0x0000000003030000-0x000000000391B000-memory.dmp	family_glupteba
behavioral1/memory/1936-304-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3496-306-0x0000000002E10000-0x00000000036FB000-memory.dmp	family_glupteba
behavioral1/memory/3496-307-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3496-545-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3496-556-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3496-807-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3496-1050-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1052-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1154-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1646-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1797-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1798-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1799-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1800-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1801-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1802-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1803-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/424-1804-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
316	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
424	csrss.exe
4900	injector.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe = "0"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
File created	C:\Windows\rss\csrss.exe	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5072	schtasks.exe
4644	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
1032	powershell.exe
1032	powershell.exe
1032	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
424	csrss.exe
424	csrss.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
424	csrss.exe
424	csrss.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe
4900	injector.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Token: SeImpersonatePrivilege	1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeSystemEnvironmentPrivilege	424	csrss.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4104	1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	71
PID 1936 wrote to memory of 4104	1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	71
PID 1936 wrote to memory of 4104	1936	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	71
PID 3496 wrote to memory of 4260	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	76
PID 3496 wrote to memory of 4260	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	76
PID 3496 wrote to memory of 4260	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	76
PID 3496 wrote to memory of 436	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	79
PID 3496 wrote to memory of 436	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	79
PID 436 wrote to memory of 316	436	cmd.exe	80
PID 436 wrote to memory of 316	436	cmd.exe	80
PID 3496 wrote to memory of 1032	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	81
PID 3496 wrote to memory of 1032	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	81
PID 3496 wrote to memory of 1032	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	81
PID 3496 wrote to memory of 2772	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	83
PID 3496 wrote to memory of 2772	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	83
PID 3496 wrote to memory of 2772	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	83
PID 3496 wrote to memory of 424	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	85
PID 3496 wrote to memory of 424	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	85
PID 3496 wrote to memory of 424	3496	24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe	85
PID 424 wrote to memory of 5000	424	csrss.exe	86
PID 424 wrote to memory of 5000	424	csrss.exe	86
PID 424 wrote to memory of 5000	424	csrss.exe	86
PID 424 wrote to memory of 3972	424	csrss.exe	92
PID 424 wrote to memory of 3972	424	csrss.exe	92
PID 424 wrote to memory of 3972	424	csrss.exe	92
PID 424 wrote to memory of 5028	424	csrss.exe	95
PID 424 wrote to memory of 5028	424	csrss.exe	95
PID 424 wrote to memory of 5028	424	csrss.exe	95
PID 424 wrote to memory of 4900	424	csrss.exe	97
PID 424 wrote to memory of 4900	424	csrss.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
"C:\Users\Admin\AppData\Local\Temp\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe
  "C:\Users\Admin\AppData\Local\Temp\24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:5072
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4900
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xsa2riri.pv1.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b4b05b52a8f66c7494ce9a9252679cad

SHA1
e364248258791030ad48a3d22fabbae269623c3c

SHA256
24e0fae21a9e18f9cbc1c6a63b6c84c46e5f6b6cc5ed02fc46d1ea57b93a619e

SHA512
1e62e44c0850d942bd0c2783930f06b6b9cf8aef83d28cc8e55ae6b516d7559f5e79fd122c244a3b1395f40a6dde49caf16688e3e46b76a59384f4b695b84064

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
5a6d8b2bf3e4f9a233527428b74ab8ce

SHA1
36151820fc5898ca134248e40404d079c28514b7

SHA256
d74bc2380143bda481d6ad2cbfe5803998701b6163b8b08408907e377988e729

SHA512
2e6b302b2974286380243f10080ed30d59aaeec8f8c80dac0aa6945f170d97cbf3bc4c8a8fd44022eaf6c08227ccdface7ae3c0b98b66b99be9dcf82f70e9a6e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
0e7c015feb8ba1748e7a3e6d1ef07a11

SHA1
055ef554582f6e6e0afb8d35d00cd229bc94c554

SHA256
f80e423935fac235238734a3d0c09899e730ac80748d8216463e4184d6a9c6b6

SHA512
e68e252b9f0478f5916ec5ad2862718b1b17ebcfd6df29699695e803c70911f22e721bd4e37b275c9cd0214469608ebd13182b234480bc835d3b3454baf040f0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
c7aea93fd88c1b476f4313a3394480d3

SHA1
24f97e8a64d75e6f2876408c0f5697178daa7a2b

SHA256
bdc454395b29c38259e990d8024e380d23f14a02da2a1f0dd45a38e16f981bd1

SHA512
3b73ce86a8c3a751d8ce5c0e7b97b0b7d7264ad4d884e7974b8dc8388f702d5c2014a8c13a209b55971fb2bda168efa9e01a5f89e4292d9286407680e59c6a28

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
6e31611d3a59b52cc16e46d7319ce28b

SHA1
d34249a2d4e2cd1eeb4c73b972623675b5300e4a

SHA256
11b0de3957c5adb85920c3fb43d25073e1377bdf21bdf8a21b95b5a8d24c52f6

SHA512
2da987d4bb87f7b4f55955647ea35f57c791b9fb923b3045b38379e520c93b04c7e1ddc5a744932db6d7fda3f082abf5e9eaf54d77da9c74f459420256a581f5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
3eb71040bc91b8c1fbb0568233fb9c14

SHA1
37cd96b56d9b89e6c7f5cdc4e614be9646a1909c

SHA256
24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda

SHA512
e226308f3f5611c208039f6103883e13952758c2a9952ab2eabd61e91bcf2266a1fa43d6dfa90120d70815dad1b844d6812ad76dfb57aeb7ea360efe9d149983

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
3eb71040bc91b8c1fbb0568233fb9c14

SHA1
37cd96b56d9b89e6c7f5cdc4e614be9646a1909c

SHA256
24aec3d190118b2444ff565edfa5027ecf30b57abc19c33eaa0da2e219ca0bda

SHA512
e226308f3f5611c208039f6103883e13952758c2a9952ab2eabd61e91bcf2266a1fa43d6dfa90120d70815dad1b844d6812ad76dfb57aeb7ea360efe9d149983

Download Submit
memory/424-1052-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1154-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1797-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1646-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1798-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1799-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1800-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1804-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1803-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1802-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1801-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/424-1051-0x0000000002F00000-0x00000000032F8000-memory.dmp

Filesize
4.0MB

Download
memory/1032-561-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/1032-587-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/1032-581-0x0000000070540000-0x000000007058B000-memory.dmp

Filesize
300KB

Download
memory/1032-560-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/1032-800-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/1032-582-0x0000000070590000-0x00000000708E0000-memory.dmp

Filesize
3.3MB

Download
memory/1936-69-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1936-14-0x0000000002C30000-0x0000000003028000-memory.dmp

Filesize
4.0MB

Download
memory/1936-2-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1936-304-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1936-1-0x0000000003030000-0x000000000391B000-memory.dmp

Filesize
8.9MB

Download
memory/1936-0-0x0000000002C30000-0x0000000003028000-memory.dmp

Filesize
4.0MB

Download
memory/1936-70-0x0000000003030000-0x000000000391B000-memory.dmp

Filesize
8.9MB

Download
memory/2772-827-0x0000000070590000-0x00000000708E0000-memory.dmp

Filesize
3.3MB

Download
memory/2772-832-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/2772-805-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/2772-804-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/2772-803-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2772-1045-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2772-826-0x0000000070540000-0x000000007058B000-memory.dmp

Filesize
300KB

Download
memory/3496-305-0x0000000002A10000-0x0000000002E08000-memory.dmp

Filesize
4.0MB

Download
memory/3496-306-0x0000000002E10000-0x00000000036FB000-memory.dmp

Filesize
8.9MB

Download
memory/3496-545-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3496-807-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3496-556-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3496-307-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3496-1050-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4104-77-0x0000000070420000-0x000000007046B000-memory.dmp

Filesize
300KB

Download
memory/4104-35-0x00000000098C0000-0x00000000098FC000-memory.dmp

Filesize
240KB

Download
memory/4104-6-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4104-5-0x0000000005300000-0x0000000005336000-memory.dmp

Filesize
216KB

Download
memory/4104-7-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/4104-8-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/4104-9-0x0000000007A60000-0x0000000008088000-memory.dmp

Filesize
6.2MB

Download
memory/4104-10-0x0000000008090000-0x00000000080B2000-memory.dmp

Filesize
136KB

Download
memory/4104-11-0x0000000008130000-0x0000000008196000-memory.dmp

Filesize
408KB

Download
memory/4104-12-0x0000000008380000-0x00000000083E6000-memory.dmp

Filesize
408KB

Download
memory/4104-13-0x00000000084C0000-0x0000000008810000-memory.dmp

Filesize
3.3MB

Download
memory/4104-303-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4104-285-0x000000000A920000-0x000000000A928000-memory.dmp

Filesize
32KB

Download
memory/4104-280-0x000000000A930000-0x000000000A94A000-memory.dmp

Filesize
104KB

Download
memory/4104-87-0x000000000A9B0000-0x000000000AA44000-memory.dmp

Filesize
592KB

Download
memory/4104-86-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/4104-85-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4104-84-0x000000000A7F0000-0x000000000A895000-memory.dmp

Filesize
660KB

Download
memory/4104-79-0x000000000A770000-0x000000000A78E000-memory.dmp

Filesize
120KB

Download
memory/4104-78-0x0000000070470000-0x00000000707C0000-memory.dmp

Filesize
3.3MB

Download
memory/4104-15-0x0000000008470000-0x000000000848C000-memory.dmp

Filesize
112KB

Download
memory/4104-16-0x0000000008D60000-0x0000000008DAB000-memory.dmp

Filesize
300KB

Download
memory/4104-76-0x000000000A7B0000-0x000000000A7E3000-memory.dmp

Filesize
204KB

Download
memory/4104-66-0x0000000009980000-0x00000000099F6000-memory.dmp

Filesize
472KB

Download
memory/4104-75-0x000000007E490000-0x000000007E4A0000-memory.dmp

Filesize
64KB

Download
memory/4260-310-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4260-311-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/4260-340-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/4260-555-0x0000000073810000-0x0000000073EFE000-memory.dmp

Filesize
6.9MB

Download
memory/4260-339-0x0000000009930000-0x00000000099D5000-memory.dmp

Filesize
660KB

Download
memory/4260-334-0x0000000070590000-0x00000000708E0000-memory.dmp

Filesize
3.3MB

Download
memory/4260-333-0x0000000070540000-0x000000007058B000-memory.dmp

Filesize
300KB

Download
memory/4260-314-0x00000000085E0000-0x000000000862B000-memory.dmp

Filesize
300KB

Download
memory/4260-312-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/4260-313-0x0000000008040000-0x0000000008390000-memory.dmp

Filesize
3.3MB

Download
memory/5000-1078-0x00000000704A0000-0x00000000704EB000-memory.dmp

Filesize
300KB

Download
memory/5000-1077-0x000000007F450000-0x000000007F460000-memory.dmp

Filesize
64KB

Download
memory/5000-1055-0x0000000073770000-0x0000000073E5E000-memory.dmp

Filesize
6.9MB

Download
memory/5000-1056-0x0000000007AC0000-0x0000000007E10000-memory.dmp

Filesize
3.3MB

Download
memory/5000-1058-0x0000000008440000-0x000000000848B000-memory.dmp

Filesize
300KB

Download