glupteba | be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Size

4.1MB
MD5

96fb9559a584f28b6438a82bb3825315
SHA1

d287d3aa7b60e52bf4cb5a3723a94772272547b6
SHA256

be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3
SHA512

7b5d755451c541eef6157951690e72249536e5ce714ef8dd29e71abb19164276e7387bda1a65e42e6c208617ef2744cc5be8d0c82fc340117efd831d137015fc
SSDEEP

98304:QRTkDuHgmYx/lUN44oPlaFTRDd8Vl17ZH+qKHzyof587dicDjgk:KumYx/lUN44oEJmBCTyoq7dicJ

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

resource	yara_rule
behavioral2/memory/1684-1-0x0000000003000000-0x00000000038EB000-memory.dmp	family_glupteba
behavioral2/memory/1684-2-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1684-3-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1684-5-0x0000000003000000-0x00000000038EB000-memory.dmp	family_glupteba
behavioral2/memory/1684-6-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1684-7-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1684-58-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-60-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-62-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-76-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-93-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-122-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/840-170-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/372-216-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/372-269-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/372-271-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/372-273-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/372-275-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4696	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
372	csrss.exe
4648	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
File created	C:\Windows\rss\csrss.exe	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2224	schtasks.exe
4144	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
456	powershell.exe
456	powershell.exe
1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
2192	powershell.exe
2192	powershell.exe
2192	powershell.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
372	csrss.exe
372	csrss.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe
4648	injector.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	powershell.exe
Token: SeDebugPrivilege	1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Token: SeImpersonatePrivilege	1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeSystemEnvironmentPrivilege	372	csrss.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 456	1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	93
PID 1684 wrote to memory of 456	1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	93
PID 1684 wrote to memory of 456	1684	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	93
PID 840 wrote to memory of 2192	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	102
PID 840 wrote to memory of 2192	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	102
PID 840 wrote to memory of 2192	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	102
PID 840 wrote to memory of 3352	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	105
PID 840 wrote to memory of 3352	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	105
PID 3352 wrote to memory of 4696	3352	cmd.exe	107
PID 3352 wrote to memory of 4696	3352	cmd.exe	107
PID 840 wrote to memory of 1700	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	108
PID 840 wrote to memory of 1700	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	108
PID 840 wrote to memory of 1700	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	108
PID 840 wrote to memory of 3684	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	110
PID 840 wrote to memory of 3684	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	110
PID 840 wrote to memory of 3684	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	110
PID 840 wrote to memory of 372	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	112
PID 840 wrote to memory of 372	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	112
PID 840 wrote to memory of 372	840	be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe	112
PID 372 wrote to memory of 3552	372	csrss.exe	113
PID 372 wrote to memory of 3552	372	csrss.exe	113
PID 372 wrote to memory of 3552	372	csrss.exe	113
PID 372 wrote to memory of 1248	372	csrss.exe	119
PID 372 wrote to memory of 1248	372	csrss.exe	119
PID 372 wrote to memory of 1248	372	csrss.exe	119
PID 372 wrote to memory of 4880	372	csrss.exe	121
PID 372 wrote to memory of 4880	372	csrss.exe	121
PID 372 wrote to memory of 4880	372	csrss.exe	121
PID 372 wrote to memory of 4648	372	csrss.exe	124
PID 372 wrote to memory of 4648	372	csrss.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
"C:\Users\Admin\AppData\Local\Temp\be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Users\Admin\AppData\Local\Temp\be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe
  "C:\Users\Admin\AppData\Local\Temp\be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3552
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2224
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4296
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1248
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4648
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nhptkrjq.3j2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
35KB

MD5
c0c4404d7fa40cfc426fa66648e532c2

SHA1
d60dcafc42c6cca766a81d5bfdd8e86978940db0

SHA256
ca8746b989ce25d54f1b7fa117f804f162d842228b7f6e9422aeaf0cc6a017f3

SHA512
c84bb02966316ee10a38f35516964e4b2730a4a36ede9e13e8b3cf8669756dc7ed44fa5d06e30347050b854e6f82219a38db13dce3b16138354aa331c73d02b9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ed9e7cf4a70fe71f6317c9c233875b5d

SHA1
1a8d34be71666658e1ef35cb1d3008e00abcf552

SHA256
2c696383c1bd235c0e1708b58c88fa433204956c7fa06d5fc4af66fd5f6ff0fe

SHA512
c6bddc191706221f178c5722d047f9bbb9a78cec94738dc50d48c33f968ab90cef8bb2fe23e9ad952338ce8321b5f23ffb722038d5ab515b19ed582360dc04c3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
5933f5524840e75ad9a94024fda0c75c

SHA1
69d13bb5d1248bea53280ab76a25af662fd5d510

SHA256
041f427fb322f48802cc693bc1446acd0a116381ea0b057e2ba28802f7d82daf

SHA512
3bfeef4b0fa089c84b0f07fa7d921a7cb6bab5bef0c4ee82dc8786d1ca2543503d1cd01dcbb2ff5c39f9774a06436772418fb41143bb34c661c4ce1d1fed35ca

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f27a0a98587b4f2a427eba69976926b4

SHA1
096256486a92a815bf06f93ad1a150ed4b965905

SHA256
6375f0590ad627454f8f6bef1cd25656d0175e0c9b8dad6be2815d85215bb2cb

SHA512
e9943691ebb7f853e8d30a6243f65df2ddd975cd0ab2247110f9b6cc6827c22e3a7ca1538fcf39433c89e41daed7f66b7913f74c4a0e81ddc4daa5244ea1a8b0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
3293027792559478c6b9a12b4b7b561a

SHA1
ee07cad367be081d8d989401eb951530178090dd

SHA256
7694c061637f6dbf7d71ae196bf11c94cb2d796e6dd29ff075faf50c5289da4a

SHA512
cb0274f71c767a9c0a5025cec92545c3dd58777ac9c05bbfbf077bf80796f37260563beed075fa2c342ce916ef67a916ef48292357a1853062354743f56ad018

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f27375e6a7212233f990349f02e05fce

SHA1
23a70d7d7e5ee197f7628503d218bbdce0f3cdb3

SHA256
f45207f6aa81999ba98f9c5e09acefc02f6034372843242b095878530f33fb75

SHA512
8fa39bcae47a3d62ca06a26a8b68a07ae6a85342fb711056ef53741016b93aa79dd57b04be14af3195ec5b07a091df50a6382abc276f804222c047e9e8f8173c

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
96fb9559a584f28b6438a82bb3825315

SHA1
d287d3aa7b60e52bf4cb5a3723a94772272547b6

SHA256
be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3

SHA512
7b5d755451c541eef6157951690e72249536e5ce714ef8dd29e71abb19164276e7387bda1a65e42e6c208617ef2744cc5be8d0c82fc340117efd831d137015fc

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
96fb9559a584f28b6438a82bb3825315

SHA1
d287d3aa7b60e52bf4cb5a3723a94772272547b6

SHA256
be07903bd984dfffa1a14aabacb0d0d64d45bab75ac30c78dccf2fbbac54d5a3

SHA512
7b5d755451c541eef6157951690e72249536e5ce714ef8dd29e71abb19164276e7387bda1a65e42e6c208617ef2744cc5be8d0c82fc340117efd831d137015fc

Download Submit
memory/372-216-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/372-269-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/372-271-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/372-275-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/372-273-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/456-14-0x00000000057A0000-0x0000000005806000-memory.dmp

Filesize
408KB

Download
memory/456-9-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/456-27-0x0000000006490000-0x00000000064D4000-memory.dmp

Filesize
272KB

Download
memory/456-28-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/456-29-0x0000000007060000-0x00000000070D6000-memory.dmp

Filesize
472KB

Download
memory/456-30-0x0000000007760000-0x0000000007DDA000-memory.dmp

Filesize
6.5MB

Download
memory/456-31-0x0000000007100000-0x000000000711A000-memory.dmp

Filesize
104KB

Download
memory/456-32-0x000000007F930000-0x000000007F940000-memory.dmp

Filesize
64KB

Download
memory/456-33-0x00000000074C0000-0x00000000074F2000-memory.dmp

Filesize
200KB

Download
memory/456-34-0x00000000701C0000-0x000000007020C000-memory.dmp

Filesize
304KB

Download
memory/456-35-0x0000000070360000-0x00000000706B4000-memory.dmp

Filesize
3.3MB

Download
memory/456-45-0x00000000074A0000-0x00000000074BE000-memory.dmp

Filesize
120KB

Download
memory/456-46-0x0000000007500000-0x00000000075A3000-memory.dmp

Filesize
652KB

Download
memory/456-47-0x00000000075F0000-0x00000000075FA000-memory.dmp

Filesize
40KB

Download
memory/456-48-0x00000000076B0000-0x0000000007746000-memory.dmp

Filesize
600KB

Download
memory/456-49-0x0000000007610000-0x0000000007621000-memory.dmp

Filesize
68KB

Download
memory/456-50-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/456-51-0x0000000007650000-0x000000000765E000-memory.dmp

Filesize
56KB

Download
memory/456-52-0x0000000007660000-0x0000000007674000-memory.dmp

Filesize
80KB

Download
memory/456-53-0x0000000007DE0000-0x0000000007DFA000-memory.dmp

Filesize
104KB

Download
memory/456-54-0x00000000076A0000-0x00000000076A8000-memory.dmp

Filesize
32KB

Download
memory/456-57-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/456-8-0x00000000025F0000-0x0000000002626000-memory.dmp

Filesize
216KB

Download
memory/456-26-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Filesize
304KB

Download
memory/456-10-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/456-11-0x0000000005100000-0x0000000005728000-memory.dmp

Filesize
6.2MB

Download
memory/456-25-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/456-24-0x00000000058E0000-0x0000000005C34000-memory.dmp

Filesize
3.3MB

Download
memory/456-12-0x0000000004F40000-0x0000000004F62000-memory.dmp

Filesize
136KB

Download
memory/456-13-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/840-170-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/840-76-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/840-62-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/840-60-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/840-59-0x0000000002B90000-0x0000000002F88000-memory.dmp

Filesize
4.0MB

Download
memory/840-122-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/840-93-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-6-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-7-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-0-0x0000000002C00000-0x0000000002FF8000-memory.dmp

Filesize
4.0MB

Download
memory/1684-5-0x0000000003000000-0x00000000038EB000-memory.dmp

Filesize
8.9MB

Download
memory/1684-4-0x0000000002C00000-0x0000000002FF8000-memory.dmp

Filesize
4.0MB

Download
memory/1684-3-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-58-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-2-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1684-1-0x0000000003000000-0x00000000038EB000-memory.dmp

Filesize
8.9MB

Download
memory/1700-109-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/1700-125-0x000000007FCB0000-0x000000007FCC0000-memory.dmp

Filesize
64KB

Download
memory/1700-107-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/1700-119-0x0000000005BC0000-0x0000000005F14000-memory.dmp

Filesize
3.3MB

Download
memory/1700-108-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/1700-127-0x0000000070340000-0x0000000070694000-memory.dmp

Filesize
3.3MB

Download
memory/1700-123-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/1700-126-0x00000000701C0000-0x000000007020C000-memory.dmp

Filesize
304KB

Download
memory/2192-95-0x0000000007180000-0x0000000007191000-memory.dmp

Filesize
68KB

Download
memory/2192-80-0x000000007F870000-0x000000007F880000-memory.dmp

Filesize
64KB

Download
memory/2192-102-0x00000000071D0000-0x00000000071E4000-memory.dmp

Filesize
80KB

Download
memory/2192-97-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-96-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-105-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/2192-94-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-91-0x0000000006E80000-0x0000000006F23000-memory.dmp

Filesize
652KB

Download
memory/2192-81-0x0000000070940000-0x0000000070C94000-memory.dmp

Filesize
3.3MB

Download
memory/2192-98-0x000000007F870000-0x000000007F880000-memory.dmp

Filesize
64KB

Download
memory/2192-78-0x00000000701C0000-0x000000007020C000-memory.dmp

Filesize
304KB

Download
memory/2192-79-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/2192-77-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-71-0x0000000005650000-0x00000000059A4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-64-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-65-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/2192-63-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download