glupteba | b79c2d817b0ced7a0f16ebbb1a91defae311debe95bf3e54b8194003bb9985c5

Analysis

max time kernel
78s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89dbbd2f1461d68ee434f6892130a1b1.exe
Size

4.2MB
MD5

89dbbd2f1461d68ee434f6892130a1b1
SHA1

4e145e27f03fc19db5d148587fd58edabc5f05fd
SHA256

b79c2d817b0ced7a0f16ebbb1a91defae311debe95bf3e54b8194003bb9985c5
SHA512

32d909207414d3a2c92d1b856b24261ba5cfa9ac290a1ef32982684b788cc12aef480549a769118a59f6f14c5bcc6d862b61d4d9ab622ee7d16b9549ad865d08
SSDEEP

98304:teW8UzsHIbLf9dWRHWVRhdNR5S1sJRNc/DhpLv/dFcsAkZ5z:q0L1dWRH6Rb9w/n3rVAkT

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1688-2-0x0000000003F90000-0x000000000487B000-memory.dmp	family_glupteba
behavioral2/memory/1688-3-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/1688-4-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/1688-6-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/1688-12-0x0000000003F90000-0x000000000487B000-memory.dmp	family_glupteba
behavioral2/memory/1688-57-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/1688-62-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/3164-64-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/3164-98-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/3164-159-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-231-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-264-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-273-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-275-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-277-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-279-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-281-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba
behavioral2/memory/4624-283-0x0000000000400000-0x0000000001E17000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
3412	netsh.exe

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid	Process
4624	csrss.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x00080000000232a3-267.dat	upx
behavioral2/files/0x00080000000232a3-269.dat	upx
behavioral2/files/0x00080000000232a3-270.dat	upx
behavioral2/memory/5020-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2172-274-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2172-278-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2172-284-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

89dbbd2f1461d68ee434f6892130a1b1.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	89dbbd2f1461d68ee434f6892130a1b1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

Processes:

89dbbd2f1461d68ee434f6892130a1b1.exe

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	89dbbd2f1461d68ee434f6892130a1b1.exe

Drops file in Windows directory 2 IoCs

Processes:

89dbbd2f1461d68ee434f6892130a1b1.exe

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	89dbbd2f1461d68ee434f6892130a1b1.exe
File opened for modification	C:\Windows\rss	89dbbd2f1461d68ee434f6892130a1b1.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
3924	sc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4596	1688	WerFault.exe	94

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
4284	schtasks.exe
3044	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe89dbbd2f1461d68ee434f6892130a1b1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	89dbbd2f1461d68ee434f6892130a1b1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

powershell.exe89dbbd2f1461d68ee434f6892130a1b1.exepowershell.exe89dbbd2f1461d68ee434f6892130a1b1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3184	powershell.exe
3184	powershell.exe
3184	powershell.exe
1688	89dbbd2f1461d68ee434f6892130a1b1.exe
1688	89dbbd2f1461d68ee434f6892130a1b1.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3164	89dbbd2f1461d68ee434f6892130a1b1.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
844	powershell.exe
844	powershell.exe
844	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
2120	powershell.exe
2120	powershell.exe
2120	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

powershell.exe89dbbd2f1461d68ee434f6892130a1b1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	1688	89dbbd2f1461d68ee434f6892130a1b1.exe
Token: SeImpersonatePrivilege	1688	89dbbd2f1461d68ee434f6892130a1b1.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

89dbbd2f1461d68ee434f6892130a1b1.exe89dbbd2f1461d68ee434f6892130a1b1.execmd.execsrss.exe

description	pid	Process	procid_target
PID 1688 wrote to memory of 3184	1688	89dbbd2f1461d68ee434f6892130a1b1.exe	101
PID 1688 wrote to memory of 3184	1688	89dbbd2f1461d68ee434f6892130a1b1.exe	101
PID 1688 wrote to memory of 3184	1688	89dbbd2f1461d68ee434f6892130a1b1.exe	101
PID 3164 wrote to memory of 4496	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	115
PID 3164 wrote to memory of 4496	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	115
PID 3164 wrote to memory of 4496	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	115
PID 3164 wrote to memory of 4516	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	117
PID 3164 wrote to memory of 4516	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	117
PID 4516 wrote to memory of 3412	4516	cmd.exe	119
PID 4516 wrote to memory of 3412	4516	cmd.exe	119
PID 3164 wrote to memory of 3304	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	122
PID 3164 wrote to memory of 3304	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	122
PID 3164 wrote to memory of 3304	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	122
PID 3164 wrote to memory of 844	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	124
PID 3164 wrote to memory of 844	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	124
PID 3164 wrote to memory of 844	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	124
PID 3164 wrote to memory of 4624	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	126
PID 3164 wrote to memory of 4624	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	126
PID 3164 wrote to memory of 4624	3164	89dbbd2f1461d68ee434f6892130a1b1.exe	126
PID 4624 wrote to memory of 2748	4624	csrss.exe	127
PID 4624 wrote to memory of 2748	4624	csrss.exe	127
PID 4624 wrote to memory of 2748	4624	csrss.exe	127
PID 4624 wrote to memory of 2120	4624	csrss.exe	132
PID 4624 wrote to memory of 2120	4624	csrss.exe	132
PID 4624 wrote to memory of 2120	4624	csrss.exe	132
PID 4624 wrote to memory of 2432	4624	csrss.exe	135
PID 4624 wrote to memory of 2432	4624	csrss.exe	135
PID 4624 wrote to memory of 2432	4624	csrss.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\89dbbd2f1461d68ee434f6892130a1b1.exe
"C:\Users\Admin\AppData\Local\Temp\89dbbd2f1461d68ee434f6892130a1b1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\89dbbd2f1461d68ee434f6892130a1b1.exe
  "C:\Users\Admin\AppData\Local\Temp\89dbbd2f1461d68ee434f6892130a1b1.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3412
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2748
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4284
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1260
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:1380
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3044
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:864
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 864
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1688 -ip 1688
1⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3180

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_drcosoej.zlq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
fc859b1ed72b327ee8c0763a951fece0

SHA1
9c2beaaf648e82f766f73eb21ae1d8f30f3115e3

SHA256
ca45a2f5e673b1c321f799e74a8db38cda9c612f1385cafdfd3fe22db9de0600

SHA512
2cb2ebda14c7a8525f0a4b11e3e22f40b168ae45763e1d5e00f13f90811446cb9755249206001c40505d20f92809b97b7e23c392d0ebd9099abdabc3e5737a6f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
899073cdb0b069379a114c139463516d

SHA1
403be9da0fb1596018835227ba30c3a4aab36f24

SHA256
70123709a88cd27a575ebf7c3f6081de953aa189f537cbd9381099c06c3fa3a2

SHA512
0289568acee33147e22fe9b2cfb4d3096c02d9daf8dce156baee168835748e4032f7ae2bd34b066dab7ca5ba29eb66ad061ec0bda48bceaafb7b5d583d69a9a2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4226e71464a371123aa128500dc80e4d

SHA1
12bf5d9de09e130ae33bb9201adba1794ddf2403

SHA256
5f41bcb59ba500d3dca7f8815789220adcc9ed072a24e56cca92e1cef7638053

SHA512
e18fbfcd6a7e1a028f32ec74840866273930a1be0993149b3d181826be20c3f80ae16152e018c5a0dea1a0731cef79e9365e332dde87fffebfa70403dd6d8011

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
30702a16c81dbeaa6e10fd75c8bbcdf5

SHA1
130fbdef1a3de766b8d805cfca95ffb8bd441277

SHA256
a63219b143bc63f035bf6d046376d24e14e91a8c3ae7d78e837480c9de6c5a9a

SHA512
23938f4576a77ad3963863fb79b6e13e79314e264d17b80b4d58283712b457b7b554258baf519711e9f4245ee105da1ec9c1b6e0ac9a799dbcfc8559241299cc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3194343c746e41d3dfd423f55c21163a

SHA1
b26e7eabb25f807aeeeca73a91eecc36e0c86c14

SHA256
1296f07087adb621ddb44a61b8acbfc8960ff19f3955f42505bcc29c133fddf5

SHA512
2c04aa438a33b92326c62d5d67a340bdd2f139c61e425feab1bc339e11d1be06b946f3652f9095c12116c9d763bb3dace2767c4e392df736e8fe88553a09a31c

Download Submit
C:\Windows\rss\csrss.exe

Filesize
730KB

MD5
a3c4f9af930d3f7494f2d7b598c96469

SHA1
14e99bbb74e57d897287cd8ec9c49355d52ba9c8

SHA256
8f23a4cecd9e5572829e340d74839677db31931fd153ad0d81bd6af29d341d10

SHA512
5a63ca204b52eb65ee93ec5f08f491200e4762e3e52be2cf0509aebd8a1640607c47ca705443bf89f872edf2c75692f71d78e48745abf959b31129472af45b8d

Download Submit
C:\Windows\rss\csrss.exe

Filesize
528KB

MD5
6ce2475cac79574963d231b8ac381198

SHA1
a69cce9b84d1e27ee403d8465a0b37fb3c5801c4

SHA256
8a84048dd7594343ce1f3bea77bcc4e64737c9ad50badd7232d2cc46c59c303e

SHA512
0a56fc39e9b4ac8c24db1f3ba4395f932d7afa42661629cc0f746e247224844f8c6222b802e526d1f615f726c148402f83321892ebc03919e102e0d53884d89e

Download Submit
C:\Windows\windefender.exe

Filesize
1.8MB

MD5
8fd9d8b6e732a838fcdf27da563e8088

SHA1
d0adcfcd9036a75831259e71dc492a4cdd9f043b

SHA256
54ce93bb21b814ca2be7b74de5c87b5169769582ba58c6062b7aeff133ee429f

SHA512
507dbb39705b8c5b47694a516e722a7b3a786f182578f31f1912902d0c6e6b369650b94df4911d08be28de6d52fa330a8b18f6b190f08785c2f41b892a949cee

Download Submit
C:\Windows\windefender.exe

Filesize
1.3MB

MD5
ca1a0cb99cbc0aafa3421b242b2eebb8

SHA1
33b7d37977e3abf8e038181bdb071c9d8612d095

SHA256
ba310720c163d403f09f2c39779c989b3575f6dcaf7de8b47158a9756d0983ad

SHA512
693619dd71d668328a0733ec899a2f1883b0493b71df3783440fa6269e9bd032f3a3b3d6dcd09249bd1bead357fa13fe66b9cd796e2bf14ca025f477ef4699d6

Download Submit
C:\Windows\windefender.exe

Filesize
708KB

MD5
65324d42d8d50307894f4b6810c12fc0

SHA1
3bf4fd4281dae9493595848a2c9583bd010ede98

SHA256
90f5891c7bb485ba8089c4dc73c0d80bd647de62148bef8b365aa1b8faa993e0

SHA512
7a9fc87cdd355abe4d8651d52e847a477fdd6960829ac48ade3f6e3ac751399bf73a0858c042452939c30fd2ff9fcfb7acff5ee59c497c12364da4597889098c

Download Submit
memory/844-130-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/844-142-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/844-131-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/1688-3-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/1688-9-0x0000000003B80000-0x0000000003F88000-memory.dmp

Filesize
4.0MB

Download
memory/1688-62-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/1688-6-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/1688-2-0x0000000003F90000-0x000000000487B000-memory.dmp

Filesize
8.9MB

Download
memory/1688-12-0x0000000003F90000-0x000000000487B000-memory.dmp

Filesize
8.9MB

Download
memory/1688-4-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/1688-1-0x0000000003B80000-0x0000000003F88000-memory.dmp

Filesize
4.0MB

Download
memory/1688-57-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/2172-274-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2172-278-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2172-284-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3164-100-0x0000000003A60000-0x0000000003E60000-memory.dmp

Filesize
4.0MB

Download
memory/3164-98-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/3164-64-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/3164-63-0x0000000003A60000-0x0000000003E60000-memory.dmp

Filesize
4.0MB

Download
memory/3164-159-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/3184-33-0x0000000007960000-0x000000000797A000-memory.dmp

Filesize
104KB

Download
memory/3184-53-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

Filesize
56KB

Download
memory/3184-54-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

Filesize
80KB

Download
memory/3184-55-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

Filesize
104KB

Download
memory/3184-56-0x0000000007DA0000-0x0000000007DA8000-memory.dmp

Filesize
32KB

Download
memory/3184-52-0x0000000007C80000-0x0000000007C91000-memory.dmp

Filesize
68KB

Download
memory/3184-60-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3184-51-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3184-50-0x0000000007D00000-0x0000000007D96000-memory.dmp

Filesize
600KB

Download
memory/3184-49-0x0000000007C40000-0x0000000007C4A000-memory.dmp

Filesize
40KB

Download
memory/3184-5-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3184-7-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3184-8-0x0000000002FC0000-0x0000000002FF6000-memory.dmp

Filesize
216KB

Download
memory/3184-10-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3184-11-0x0000000005720000-0x0000000005D48000-memory.dmp

Filesize
6.2MB

Download
memory/3184-13-0x0000000005630000-0x0000000005652000-memory.dmp

Filesize
136KB

Download
memory/3184-14-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/3184-20-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/3184-25-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/3184-26-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/3184-27-0x00000000066A0000-0x00000000066EC000-memory.dmp

Filesize
304KB

Download
memory/3184-29-0x0000000006B00000-0x0000000006B44000-memory.dmp

Filesize
272KB

Download
memory/3184-30-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3184-48-0x0000000007B60000-0x0000000007C03000-memory.dmp

Filesize
652KB

Download
memory/3184-47-0x0000000007B00000-0x0000000007B1E000-memory.dmp

Filesize
120KB

Download
memory/3184-37-0x0000000070A20000-0x0000000070D74000-memory.dmp

Filesize
3.3MB

Download
memory/3184-31-0x00000000078C0000-0x0000000007936000-memory.dmp

Filesize
472KB

Download
memory/3184-32-0x0000000007FC0000-0x000000000863A000-memory.dmp

Filesize
6.5MB

Download
memory/3184-34-0x000000007EEA0000-0x000000007EEB0000-memory.dmp

Filesize
64KB

Download
memory/3184-35-0x0000000007B20000-0x0000000007B52000-memory.dmp

Filesize
200KB

Download
memory/3184-36-0x00000000708A0000-0x00000000708EC000-memory.dmp

Filesize
304KB

Download
memory/3304-115-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/3304-116-0x000000007F4E0000-0x000000007F4F0000-memory.dmp

Filesize
64KB

Download
memory/3304-117-0x00000000709A0000-0x00000000709EC000-memory.dmp

Filesize
304KB

Download
memory/3304-118-0x0000000070B20000-0x0000000070E74000-memory.dmp

Filesize
3.3MB

Download
memory/3304-129-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3304-113-0x00000000064B0000-0x0000000006804000-memory.dmp

Filesize
3.3MB

Download
memory/3304-103-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/3304-101-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/3304-102-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/4496-82-0x0000000071140000-0x0000000071494000-memory.dmp

Filesize
3.3MB

Download
memory/4496-77-0x0000000005720000-0x0000000005A74000-memory.dmp

Filesize
3.3MB

Download
memory/4496-93-0x00000000072A0000-0x00000000072B1000-memory.dmp

Filesize
68KB

Download
memory/4496-92-0x0000000006F80000-0x0000000007023000-memory.dmp

Filesize
652KB

Download
memory/4496-81-0x00000000709A0000-0x00000000709EC000-memory.dmp

Filesize
304KB

Download
memory/4496-65-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4496-97-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4496-80-0x000000007FB70000-0x000000007FB80000-memory.dmp

Filesize
64KB

Download
memory/4496-66-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4496-79-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4496-78-0x0000000005E10000-0x0000000005E5C000-memory.dmp

Filesize
304KB

Download
memory/4496-94-0x0000000007310000-0x0000000007324000-memory.dmp

Filesize
80KB

Download
memory/4496-67-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4624-273-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-275-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-277-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-264-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-279-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-281-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-283-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/4624-231-0x0000000000400000-0x0000000001E17000-memory.dmp

Filesize
26.1MB

Download
memory/5020-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download