glupteba | eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Size

4.2MB
MD5

aff082231e99a080df7f3d8b5a17f5a6
SHA1

d17740b4b2f6ca632de7d67e7ebb68cf0dbe1efe
SHA256

eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf
SHA512

0bd083ecdcd51aa6d3cd0dc80e24bc2297f1e0f4e1f1e7ef76896b8468d26a15e081908d2a714bcfd6162793452ff19322add76a20186de53942446c8798540c
SSDEEP

98304:7Qx1mA16Q9J7UePP+dPnQjqZi7LPRPOwseq2a6JLSzHqqZL9v:M1me6QH4ePoPZALPRP/Qqwx

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

resource	yara_rule
behavioral1/memory/4564-2-0x0000000003070000-0x000000000395B000-memory.dmp	family_glupteba
behavioral1/memory/4564-3-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/4564-50-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/4564-57-0x0000000003070000-0x000000000395B000-memory.dmp	family_glupteba
behavioral1/memory/4564-56-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/2624-59-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/2624-93-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/2624-154-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-241-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-262-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-271-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-273-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-275-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-277-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-279-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-281-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-283-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-285-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral1/memory/380-287-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3440	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
380	csrss.exe
568	injector.exe
4244	windefender.exe
4140	windefender.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023271-265.dat	upx
behavioral1/files/0x0008000000023271-267.dat	upx
behavioral1/files/0x0008000000023271-268.dat	upx
behavioral1/memory/4244-270-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4140-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4140-276-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
File created	C:\Windows\rss\csrss.exe	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4876	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	4564	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1548	schtasks.exe
1516	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-12 = "Azores Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe
4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
772	powershell.exe
772	powershell.exe
772	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
380	csrss.exe
380	csrss.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
380	csrss.exe
380	csrss.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
380	csrss.exe
380	csrss.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe
568	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Token: SeImpersonatePrivilege	4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeSystemEnvironmentPrivilege	380	csrss.exe
Token: SeSecurityPrivilege	4876	sc.exe
Token: SeSecurityPrivilege	4876	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3348	4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	93
PID 4564 wrote to memory of 3348	4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	93
PID 4564 wrote to memory of 3348	4564	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	93
PID 2624 wrote to memory of 4348	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	107
PID 2624 wrote to memory of 4348	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	107
PID 2624 wrote to memory of 4348	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	107
PID 2624 wrote to memory of 2512	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	109
PID 2624 wrote to memory of 2512	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	109
PID 2512 wrote to memory of 3440	2512	cmd.exe	111
PID 2512 wrote to memory of 3440	2512	cmd.exe	111
PID 2624 wrote to memory of 2076	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	112
PID 2624 wrote to memory of 2076	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	112
PID 2624 wrote to memory of 2076	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	112
PID 2624 wrote to memory of 1152	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	114
PID 2624 wrote to memory of 1152	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	114
PID 2624 wrote to memory of 1152	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	114
PID 2624 wrote to memory of 380	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	117
PID 2624 wrote to memory of 380	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	117
PID 2624 wrote to memory of 380	2624	eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe	117
PID 380 wrote to memory of 772	380	csrss.exe	118
PID 380 wrote to memory of 772	380	csrss.exe	118
PID 380 wrote to memory of 772	380	csrss.exe	118
PID 380 wrote to memory of 3988	380	csrss.exe	124
PID 380 wrote to memory of 3988	380	csrss.exe	124
PID 380 wrote to memory of 3988	380	csrss.exe	124
PID 380 wrote to memory of 3964	380	csrss.exe	127
PID 380 wrote to memory of 3964	380	csrss.exe	127
PID 380 wrote to memory of 3964	380	csrss.exe	127
PID 380 wrote to memory of 568	380	csrss.exe	130
PID 380 wrote to memory of 568	380	csrss.exe	130
PID 4244 wrote to memory of 3500	4244	windefender.exe	140
PID 4244 wrote to memory of 3500	4244	windefender.exe	140
PID 4244 wrote to memory of 3500	4244	windefender.exe	140
PID 3500 wrote to memory of 4876	3500	cmd.exe	141
PID 3500 wrote to memory of 4876	3500	cmd.exe	141
PID 3500 wrote to memory of 4876	3500	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
"C:\Users\Admin\AppData\Local\Temp\eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe
  "C:\Users\Admin\AppData\Local\Temp\eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1548
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:568
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1516
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3500
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 756
  2⤵
  - Program crash
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4564 -ip 4564
1⤵
PID:3048

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcwevt2z.msb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
26d4b2540442745f80ccb7a0808a1e67

SHA1
5843aee7b5df6b0d0746c38d026844199343c72f

SHA256
a04e10ab5aa56d46b096221e2677e1dc4fb358de5d0d2fb3e10fd308e2f00b5e

SHA512
3c244fd33c243477364228012ab55c59a4dd35ac7c77dc2428fc1b79406852d763a470ef197293fa50a815590e04a72069d4a35f3b5dbf13ed3ecd648566ef6a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
48ef8f1af6edbd6612b4437edff1e660

SHA1
6a3b4bfe36b56490955cfba83a755ed11fbf9cbc

SHA256
d013f5be1a16b7cb427924b8713e8267cc2034463f735767421f1b4bac607b0d

SHA512
524e063703e80fba27b71d7966fd47cecfca04c44afdaffb978c98cd5cf789ee8151ee2a44f8c9b6ab4d4bf425e8e0d4403d79ea46184e44fa87415e72db13ad

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0487e17a2f4d8e46caede820fd254bd4

SHA1
f000adeac09b84cb63867c672add71d916c17ffe

SHA256
8ac66ce3d8e4458e128a7e10d403cacabaff6b4494e682cc2407a94bd6705a07

SHA512
d259085142d864f2193243ada46d74cc1a974e040a4fe98798de5920fffe8a3135bf116b7065fd8438b21425322d87a578d9e05e67c033cfcbd70e7136df01b2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
8d3b5dd53b857fa41ce0c7ac49ffc8e5

SHA1
18e20ca6c3f11650b9f40292ad3acf6eedf62e46

SHA256
83d4de1955ae713303ce832e2a71d14b9e975533fa873159fdc4ff0ef9b04522

SHA512
805497474a0fae2048a6f4d417530d00a50d75c883369edd2c439af9f31faaf716e9bb82fa48f693ef4aba06a62b3ccb493af346c8018623bb297b7b048c738c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
36e9ea6a82bdad658eaa9687bb96dbc7

SHA1
9f54b397f104cfae0fbea51cfff26b0183f2eea8

SHA256
cc58788b0287f2cff2fa7fc09ff3a62a34dacc9bf895ae1477c1048b33a816de

SHA512
eebb09d5002af5029c04efa0a825303ea3d542b9d55ac1acbe80e639ef271d50a3e888895b526b28ea8d525cd8536b0c36df480baabfa710367ee97cf3adf8e0

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
aff082231e99a080df7f3d8b5a17f5a6

SHA1
d17740b4b2f6ca632de7d67e7ebb68cf0dbe1efe

SHA256
eaa44c3a099ef48c57d26cd2c7d5c6079ad6bfcd74f1b3fd6a103e23dff99dbf

SHA512
0bd083ecdcd51aa6d3cd0dc80e24bc2297f1e0f4e1f1e7ef76896b8468d26a15e081908d2a714bcfd6162793452ff19322add76a20186de53942446c8798540c

Download Submit
C:\Windows\windefender.exe

Filesize
960KB

MD5
5f73b9128ecab8e5698041aa57236872

SHA1
b04a108ed5ad4c0357d3df34ca69a9b7520e36f9

SHA256
0b49e891f3a960b56182a47de95bd7720f1c5972ce54d44c511ef02d43f770d1

SHA512
ff8f7a91310eb39d754d8af9e2567db0b8583c4482c63a1e42d4add00b5146c9e09b599ae791d639cb463a1edd993dbb7dc058de764f8ef8e2d00fd58c7d05d5

Download Submit
C:\Windows\windefender.exe

Filesize
14KB

MD5
589ea2f26f903497eeb4f07f72236c0f

SHA1
64b02194c3d5dc28598316d22f9184a0b5088513

SHA256
c7358d1f37e02a83cfd67e41de7cb82790c7a8acc993bbf6c7abed83e860b428

SHA512
6fd25b84e5911c552b5498f5e390e521b0bcce028de9275bf29f5a274e517b5bcb7501597373f8a08e8fe195947e0b853e3af12bb0f824b8871c1de5cd0e3b88

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/380-275-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-285-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-262-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-273-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-241-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-277-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-279-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-281-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-283-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-271-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/380-287-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/1152-138-0x0000000070220000-0x000000007026C000-memory.dmp

Filesize
304KB

Download
memory/1152-137-0x0000000004790000-0x00000000047A0000-memory.dmp

Filesize
64KB

Download
memory/1152-139-0x00000000709E0000-0x0000000070D34000-memory.dmp

Filesize
3.3MB

Download
memory/1152-126-0x0000000005780000-0x0000000005AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1152-124-0x0000000004790000-0x00000000047A0000-memory.dmp

Filesize
64KB

Download
memory/1152-125-0x0000000004790000-0x00000000047A0000-memory.dmp

Filesize
64KB

Download
memory/1152-123-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/2076-122-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/2076-111-0x00000000709C0000-0x0000000070D14000-memory.dmp

Filesize
3.3MB

Download
memory/2076-110-0x000000007FC70000-0x000000007FC80000-memory.dmp

Filesize
64KB

Download
memory/2076-109-0x0000000070220000-0x000000007026C000-memory.dmp

Filesize
304KB

Download
memory/2076-107-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/2076-105-0x00000000057E0000-0x0000000005B34000-memory.dmp

Filesize
3.3MB

Download
memory/2076-95-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/2076-94-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/2624-108-0x0000000002AB0000-0x0000000002EB1000-memory.dmp

Filesize
4.0MB

Download
memory/2624-154-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/2624-58-0x0000000002AB0000-0x0000000002EB1000-memory.dmp

Filesize
4.0MB

Download
memory/2624-59-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/2624-93-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/3348-41-0x00000000070A0000-0x00000000070BE000-memory.dmp

Filesize
120KB

Download
memory/3348-21-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Filesize
120KB

Download
memory/3348-4-0x0000000002550000-0x0000000002586000-memory.dmp

Filesize
216KB

Download
memory/3348-6-0x00000000047A0000-0x00000000047B0000-memory.dmp

Filesize
64KB

Download
memory/3348-5-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/3348-7-0x0000000004DE0000-0x0000000005408000-memory.dmp

Filesize
6.2MB

Download
memory/3348-8-0x0000000004B50000-0x0000000004B72000-memory.dmp

Filesize
136KB

Download
memory/3348-9-0x0000000004BF0000-0x0000000004C56000-memory.dmp

Filesize
408KB

Download
memory/3348-10-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/3348-20-0x0000000005680000-0x00000000059D4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-22-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/3348-23-0x00000000060A0000-0x00000000060E4000-memory.dmp

Filesize
272KB

Download
memory/3348-24-0x00000000047A0000-0x00000000047B0000-memory.dmp

Filesize
64KB

Download
memory/3348-25-0x0000000006E60000-0x0000000006ED6000-memory.dmp

Filesize
472KB

Download
memory/3348-26-0x0000000007560000-0x0000000007BDA000-memory.dmp

Filesize
6.5MB

Download
memory/3348-53-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/3348-27-0x0000000006F00000-0x0000000006F1A000-memory.dmp

Filesize
104KB

Download
memory/3348-29-0x000000007F6E0000-0x000000007F6F0000-memory.dmp

Filesize
64KB

Download
memory/3348-49-0x00000000072A0000-0x00000000072A8000-memory.dmp

Filesize
32KB

Download
memory/3348-48-0x0000000007350000-0x000000000736A000-memory.dmp

Filesize
104KB

Download
memory/3348-47-0x0000000007260000-0x0000000007274000-memory.dmp

Filesize
80KB

Download
memory/3348-46-0x0000000007250000-0x000000000725E000-memory.dmp

Filesize
56KB

Download
memory/3348-45-0x0000000007210000-0x0000000007221000-memory.dmp

Filesize
68KB

Download
memory/3348-44-0x00000000072B0000-0x0000000007346000-memory.dmp

Filesize
600KB

Download
memory/3348-43-0x00000000071F0000-0x00000000071FA000-memory.dmp

Filesize
40KB

Download
memory/3348-42-0x0000000007100000-0x00000000071A3000-memory.dmp

Filesize
652KB

Download
memory/3348-28-0x00000000070C0000-0x00000000070F2000-memory.dmp

Filesize
200KB

Download
memory/3348-31-0x00000000702A0000-0x00000000705F4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-30-0x0000000070120000-0x000000007016C000-memory.dmp

Filesize
304KB

Download
memory/4140-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4140-276-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4244-270-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4348-73-0x0000000006B90000-0x0000000006BDC000-memory.dmp

Filesize
304KB

Download
memory/4348-91-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-62-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4348-75-0x0000000070220000-0x000000007026C000-memory.dmp

Filesize
304KB

Download
memory/4348-60-0x0000000074320000-0x0000000074AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-74-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4348-72-0x0000000006190000-0x00000000064E4000-memory.dmp

Filesize
3.3MB

Download
memory/4348-76-0x00000000703A0000-0x00000000706F4000-memory.dmp

Filesize
3.3MB

Download
memory/4348-86-0x00000000076F0000-0x0000000007793000-memory.dmp

Filesize
652KB

Download
memory/4348-87-0x0000000007C00000-0x0000000007C11000-memory.dmp

Filesize
68KB

Download
memory/4348-61-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4348-88-0x0000000007C70000-0x0000000007C84000-memory.dmp

Filesize
80KB

Download
memory/4564-50-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/4564-57-0x0000000003070000-0x000000000395B000-memory.dmp

Filesize
8.9MB

Download
memory/4564-56-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/4564-1-0x0000000002C70000-0x000000000306F000-memory.dmp

Filesize
4.0MB

Download
memory/4564-54-0x0000000002C70000-0x000000000306F000-memory.dmp

Filesize
4.0MB

Download
memory/4564-3-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/4564-2-0x0000000003070000-0x000000000395B000-memory.dmp

Filesize
8.9MB

Download