glupteba | 7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95

Analysis

max time kernel
150s
max time network
133s
platform
windows10-1703_x64
resource
win10-20231129-en
resource tags

arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
submitted
12-12-2023 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Size

4.2MB
MD5

fa2d1fdbac883808e45a30cce7fd9cdb
SHA1

0e20074b9748804d726a4b1e4d06ba8741f5dbe8
SHA256

7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95
SHA512

82fe3d721e3f21c15b46a56d539d846c6b46312b0c7a6c824035a78ff0b4797009dd67787c005f91092b6529980cab8833ec869cb2c3a780df7d9952c0a26d25
SSDEEP

98304:P+HPz90i0r5NhFDQ6Nzo46jjSHRUaZfFWAU:PA9ohpToqHRl9zU

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 21 IoCs

resource	yara_rule
behavioral1/memory/1072-2-0x0000000002F60000-0x000000000384B000-memory.dmp	family_glupteba
behavioral1/memory/1072-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1072-300-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1072-301-0x0000000002F60000-0x000000000384B000-memory.dmp	family_glupteba
behavioral1/memory/1080-304-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1080-820-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1080-1044-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1048-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1293-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1790-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1791-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1792-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1793-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1794-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1795-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1796-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1797-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1798-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1799-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1800-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4200-1801-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4440	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4200	csrss.exe
2492	injector.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3426238547-133202173-2522127025-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
File created	C:\Windows\rss\csrss.exe	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4524	schtasks.exe
2816	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
3024	powershell.exe
3024	powershell.exe
3024	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
1892	powershell.exe
1892	powershell.exe
1892	powershell.exe
4300	powershell.exe
4300	powershell.exe
4300	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
4200	csrss.exe
4200	csrss.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
4200	csrss.exe
4200	csrss.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe
2492	injector.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Token: SeImpersonatePrivilege	1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeSystemEnvironmentPrivilege	4200	csrss.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4688	1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	76
PID 1072 wrote to memory of 4688	1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	76
PID 1072 wrote to memory of 4688	1072	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	76
PID 1080 wrote to memory of 1400	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	81
PID 1080 wrote to memory of 1400	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	81
PID 1080 wrote to memory of 1400	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	81
PID 1080 wrote to memory of 4576	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	84
PID 1080 wrote to memory of 4576	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	84
PID 4576 wrote to memory of 4440	4576	cmd.exe	83
PID 4576 wrote to memory of 4440	4576	cmd.exe	83
PID 1080 wrote to memory of 3024	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	86
PID 1080 wrote to memory of 3024	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	86
PID 1080 wrote to memory of 3024	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	86
PID 1080 wrote to memory of 2212	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	87
PID 1080 wrote to memory of 2212	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	87
PID 1080 wrote to memory of 2212	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	87
PID 1080 wrote to memory of 4200	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	89
PID 1080 wrote to memory of 4200	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	89
PID 1080 wrote to memory of 4200	1080	7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe	89
PID 4200 wrote to memory of 1892	4200	csrss.exe	91
PID 4200 wrote to memory of 1892	4200	csrss.exe	91
PID 4200 wrote to memory of 1892	4200	csrss.exe	91
PID 4200 wrote to memory of 4300	4200	csrss.exe	94
PID 4200 wrote to memory of 4300	4200	csrss.exe	94
PID 4200 wrote to memory of 4300	4200	csrss.exe	94
PID 4200 wrote to memory of 4280	4200	csrss.exe	100
PID 4200 wrote to memory of 4280	4200	csrss.exe	100
PID 4200 wrote to memory of 4280	4200	csrss.exe	100
PID 4200 wrote to memory of 2492	4200	csrss.exe	101
PID 4200 wrote to memory of 2492	4200	csrss.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
"C:\Users\Admin\AppData\Local\Temp\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe
  "C:\Users\Admin\AppData\Local\Temp\7e84701cffdcf15cd6b2d84229ea5385f411e65d6e76792009c8b3483d0e0a95.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4300
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4708
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4524
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2492
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2816

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0kunhjoa.q40.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
9d2d5f2e1f21a20d2eb112ac546d01c9

SHA1
5fd9df97d8f6b13627f07a6772db6a65e41542ec

SHA256
df84600fdc64b922374805f9348117f37b478497b515669e2b5ce3f48b3766ad

SHA512
163209466daad500e7e8e10f0e0f5a0d1940ae029633bcf784d27a432f40d3b2a7ad3f7d4cf0b52c0a6e89401cefc904803a7d5e3e56f28403ff0497a4bca2fa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
21763992e006e4f0514e729f5b3a41ad

SHA1
36f5c954b81fdc1f3d8599888cc7671876bb693d

SHA256
4d2a83db4501bb92392c281887e88de5052d06de8e5c0ab817a8544c77c7f7c0

SHA512
5a49ae4bb668bdc291e21b7657eec6ee4a0e50fb47938b60fc1f7a7b4fb6aad682662981cf4f9db91921efc39ab00a45f64de690cc94b06073ba2973534dbc55

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
3624ce3d7bba0be7aa6c8faedee2bfaf

SHA1
463945f93a3843e9b77f8cd82108adecfd1c3fe6

SHA256
d6339e24183e3319e26dc76adee6b63814083fc46e03cb5a643790a476619aae

SHA512
de1e89fc922f5a54b81468a909e79c2c7f2f4df7205cba47afec4bee391978097b3546ef9749ac240b5acbed4c8f1bf98c0cc6bbaa0c149e82016f3a12bce7b6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
ec5761934368b24492638276aeb8d744

SHA1
5969ddee13f0b6c7220334ea5a26fdde0325221f

SHA256
038ea794a2f3abc2e360be08d0ca8788b6bb491c4d690e34a7b16c42b062681f

SHA512
d00734339ed2981567a9347b7f57adf17e929cc87ccfa62f9a66c96d3a17d4c0e33aea41fc81c6c0de42d56c4a0dadcf79118ed2d0f82568dd65190650763344

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
921ba6089a5b12f47f83bd35e39f20aa

SHA1
abbe929e2521a267cdc0b44c5b6553819c930253

SHA256
46bc9a4524f2a1ddac7a4b154225901c98a71b87a7fa33711c00a473a0b9d381

SHA512
504e422a129f23470371429c171bde4ada41ba2721fe3d397e93d4b06075b29054d90f777e1fd40ca91e78462be20980b52b90c66108534e84225e5f221f8e16

Download Submit
C:\Windows\rss\csrss.exe

Filesize
191KB

MD5
1afc6eba1f4fb6dc8df294ce7bb28f70

SHA1
8a2b359bc268b5a5620a7ef563600990041b63d6

SHA256
b2d20839f41cd125a724b37b1dfb3a191c5300278975ff8433505917e34ac5ac

SHA512
e61a4765cf5efa62b4548720a7bfa88b6a0d763c45be83d0ae8ef47391f87a69f4f348957ec89da9b39eaf914aedd7f2229891e2c9ad1b4044fbd237800703bc

Download Submit
C:\Windows\rss\csrss.exe

Filesize
129KB

MD5
85f82c5e6837878b46fadaf1b965c5dc

SHA1
5d494a343341195166b6d7ab5514a93d0de0557e

SHA256
50f06443ef63bea32579de1d8b8930405aedeecbb72853dcea148539d57b058e

SHA512
c8cdb6e51ca0da73066c8a5a89947a17a5fdc6de0b26b5162818095a7829e36d0f3b8e6e9366a45929e4e76828c771b74e5a5232a6f019cb0b31358322dfc149

Download Submit
memory/1072-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1072-1-0x0000000002B50000-0x0000000002F56000-memory.dmp

Filesize
4.0MB

Download
memory/1072-301-0x0000000002F60000-0x000000000384B000-memory.dmp

Filesize
8.9MB

Download
memory/1072-300-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1072-2-0x0000000002F60000-0x000000000384B000-memory.dmp

Filesize
8.9MB

Download
memory/1080-304-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1080-1044-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1080-303-0x0000000002AC0000-0x0000000002EBE000-memory.dmp

Filesize
4.0MB

Download
memory/1080-796-0x0000000002AC0000-0x0000000002EBE000-memory.dmp

Filesize
4.0MB

Download
memory/1080-820-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1400-310-0x0000000007AC0000-0x0000000007E10000-memory.dmp

Filesize
3.3MB

Download
memory/1400-337-0x0000000009620000-0x00000000096C5000-memory.dmp

Filesize
660KB

Download
memory/1400-548-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/1400-338-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1400-330-0x000000007F250000-0x000000007F260000-memory.dmp

Filesize
64KB

Download
memory/1400-331-0x000000006FD80000-0x000000006FDCB000-memory.dmp

Filesize
300KB

Download
memory/1400-332-0x000000006FDD0000-0x0000000070120000-memory.dmp

Filesize
3.3MB

Download
memory/1400-311-0x00000000081C0000-0x000000000820B000-memory.dmp

Filesize
300KB

Download
memory/1400-308-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1400-309-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/1400-307-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/1892-1053-0x0000000006D90000-0x0000000006DA0000-memory.dmp

Filesize
64KB

Download
memory/1892-1052-0x0000000006D90000-0x0000000006DA0000-memory.dmp

Filesize
64KB

Download
memory/1892-1054-0x0000000007B80000-0x0000000007ED0000-memory.dmp

Filesize
3.3MB

Download
memory/1892-1056-0x0000000008170000-0x00000000081BB000-memory.dmp

Filesize
300KB

Download
memory/1892-1051-0x0000000072FB0000-0x000000007369E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-819-0x000000006FD80000-0x000000006FDCB000-memory.dmp

Filesize
300KB

Download
memory/2212-822-0x000000006FDD0000-0x0000000070120000-memory.dmp

Filesize
3.3MB

Download
memory/2212-799-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2212-798-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2212-797-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-821-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/2212-827-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2212-1040-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-553-0x00000000069B0000-0x00000000069C0000-memory.dmp

Filesize
64KB

Download
memory/3024-552-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-554-0x00000000069B0000-0x00000000069C0000-memory.dmp

Filesize
64KB

Download
memory/3024-574-0x000000006FD80000-0x000000006FDCB000-memory.dmp

Filesize
300KB

Download
memory/3024-575-0x000000006FDD0000-0x0000000070120000-memory.dmp

Filesize
3.3MB

Download
memory/3024-580-0x00000000069B0000-0x00000000069C0000-memory.dmp

Filesize
64KB

Download
memory/3024-793-0x0000000073050000-0x000000007373E000-memory.dmp

Filesize
6.9MB

Download
memory/4200-1797-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1795-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1799-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1798-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1048-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1801-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1796-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1800-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1794-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1793-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1792-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1791-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1790-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1293-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4200-1047-0x0000000002F00000-0x00000000032F9000-memory.dmp

Filesize
4.0MB

Download
memory/4688-74-0x000000006FC60000-0x000000006FCAB000-memory.dmp

Filesize
300KB

Download
memory/4688-16-0x0000000008350000-0x000000000839B000-memory.dmp

Filesize
300KB

Download
memory/4688-12-0x0000000007C50000-0x0000000007CB6000-memory.dmp

Filesize
408KB

Download
memory/4688-13-0x0000000007DC0000-0x0000000007E26000-memory.dmp

Filesize
408KB

Download
memory/4688-10-0x0000000007550000-0x0000000007B78000-memory.dmp

Filesize
6.2MB

Download
memory/4688-9-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4688-14-0x0000000007F60000-0x00000000082B0000-memory.dmp

Filesize
3.3MB

Download
memory/4688-15-0x00000000082F0000-0x000000000830C000-memory.dmp

Filesize
112KB

Download
memory/4688-7-0x0000000072F50000-0x000000007363E000-memory.dmp

Filesize
6.9MB

Download
memory/4688-8-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4688-6-0x0000000004E70000-0x0000000004EA6000-memory.dmp

Filesize
216KB

Download
memory/4688-11-0x0000000007BB0000-0x0000000007BD2000-memory.dmp

Filesize
136KB

Download
memory/4688-27-0x0000000009330000-0x00000000093A6000-memory.dmp

Filesize
472KB

Download
memory/4688-36-0x00000000092F0000-0x000000000932C000-memory.dmp

Filesize
240KB

Download
memory/4688-73-0x000000000A2B0000-0x000000000A2E3000-memory.dmp

Filesize
204KB

Download
memory/4688-81-0x000000000A2F0000-0x000000000A395000-memory.dmp

Filesize
660KB

Download
memory/4688-76-0x000000000A290000-0x000000000A2AE000-memory.dmp

Filesize
120KB

Download
memory/4688-75-0x000000006FCB0000-0x0000000070000000-memory.dmp

Filesize
3.3MB

Download
memory/4688-82-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4688-83-0x000000000A4F0000-0x000000000A584000-memory.dmp

Filesize
592KB

Download
memory/4688-276-0x000000000A470000-0x000000000A48A000-memory.dmp

Filesize
104KB

Download
memory/4688-281-0x000000000A450000-0x000000000A458000-memory.dmp

Filesize
32KB

Download
memory/4688-299-0x0000000072F50000-0x000000007363E000-memory.dmp

Filesize
6.9MB

Download