glupteba | 0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Size

4.2MB
MD5

a1ba7703972b944f80457568e342ea46
SHA1

73ff7f896b756cc66eab3dd549e029408ae5b12b
SHA256

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a
SHA512

ca9dae5cf0c7d129ec2412419703d5452496abaa94159b1bfff8c6749ce9de573eb04516e93d8d323ccd28e2ad9d33b89adc515395c08726603ffd8ac8ec61df
SSDEEP

98304:+bvDuo/zvoC5HERRwr8YNEXJ0TS4JBXxT3BRfe7gLCxccCwfp3PGPzDBAeGjYAe:+nBoCproYNEXJ0O+Xpe7jrRPGnBARjfe

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-2-0x0000000005100000-0x00000000059EB000-memory.dmp	family_glupteba
behavioral1/memory/1708-3-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-21-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-32-0x0000000005100000-0x00000000059EB000-memory.dmp	family_glupteba
behavioral1/memory/1708-49-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-57-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-60-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-75-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-97-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-111-0x0000000003460000-0x000000000385F000-memory.dmp	family_glupteba
behavioral1/memory/4884-136-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-141-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/4884-159-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-179-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-230-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-264-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba
behavioral1/memory/1708-265-0x0000000000400000-0x0000000003009000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1436 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

csrss.exeinjector.exe

pid process

1708 csrss.exe
2600 injector.exe

pid	process
1436	netsh.exe

pid	process
1708	csrss.exe
2600	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe

Drops file in Windows directory 4 IoCs

Processes:

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
File created	C:\Windows\rss\csrss.exe	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3300 1708 WerFault.exe 0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3468 schtasks.exe
3436 schtasks.exe

pid	pid_target	process	target process
3300	1708	WerFault.exe	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe

pid	process
3468	schtasks.exe
3436	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exepowershell.exe0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4468	powershell.exe
4468	powershell.exe
1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4384	powershell.exe
4384	powershell.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
5116	powershell.exe
5116	powershell.exe
4488	powershell.exe
4488	powershell.exe
4996	powershell.exe
4996	powershell.exe
1116	powershell.exe
1116	powershell.exe
1392	powershell.exe
1392	powershell.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
1708	csrss.exe
2600	injector.exe
2600	injector.exe
1708	csrss.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
1708	csrss.exe
1708	csrss.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe
2600	injector.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

powershell.exe0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

description	pid	process
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Token: SeImpersonatePrivilege	1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1708	csrss.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.execmd.execsrss.exe

description	pid	process	target process
PID 1708 wrote to memory of 4468	1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 1708 wrote to memory of 4468	1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 1708 wrote to memory of 4468	1708	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4384	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4384	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4384	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 3724	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	cmd.exe
PID 4884 wrote to memory of 3724	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	cmd.exe
PID 3724 wrote to memory of 1436	3724	cmd.exe	netsh.exe
PID 3724 wrote to memory of 1436	3724	cmd.exe	netsh.exe
PID 4884 wrote to memory of 5116	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 5116	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 5116	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4488	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4488	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 4488	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	powershell.exe
PID 4884 wrote to memory of 1708	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	csrss.exe
PID 4884 wrote to memory of 1708	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	csrss.exe
PID 4884 wrote to memory of 1708	4884	0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe	csrss.exe
PID 1708 wrote to memory of 4996	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 4996	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 4996	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1116	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1116	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1116	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1392	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1392	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 1392	1708	csrss.exe	powershell.exe
PID 1708 wrote to memory of 2600	1708	csrss.exe	injector.exe
PID 1708 wrote to memory of 2600	1708	csrss.exe	injector.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
"C:\Users\Admin\AppData\Local\Temp\0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Users\Admin\AppData\Local\Temp\0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe
"C:\Users\Admin\AppData\Local\Temp\0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:1436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3468

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2600

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 744
2⤵
- Program crash
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1708 -ip 1708
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcqs10in.etf.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
08c6b625886d15135d7ff11459daff2d

SHA1
05cc3f0434c7f67766db5d62b4f98cb31c258791

SHA256
0a4e1db6942e484d04253ad7616508dda060ba877c937e05c1ea55a47ebc2596

SHA512
61856d2fcc738591cf0ee029f2526dea3a858b9f900cdeba1e255fa033bc2d7265a40db0ab1fec35f70254614adb33f7058a47feb949d6560af301ffd90dcd89

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
85ffe55be3b4a700c4242d53d6efdfae

SHA1
b49006cda460b8ef8578cd16a83f529ac322d7a8

SHA256
96ded4058d07b4710736fd7b4afb21eece34c5c1b5af88d84019068872f84c63

SHA512
72328c34f44ad586466b772aa17377dd4fdbcc8898d4521df663a926fa167480deb1246686c42b7ddb7a553a0f8f60d24d6eb66416ab79635c82710efc6a5d4b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
8d1fe1e27bfc961b0e1055086f1758eb

SHA1
e4d82f653a4e2b65d32ea235271218683499f4d0

SHA256
1f23f344446e81d125b54cd207574c866cd6d782b1bed863bad1e854fccec2d8

SHA512
59f36402e79a5819fd869323293bf034cd35cb57a05adfa46e113ab47a4a77915f4ddeaca99ee41f219dd39f9a0f8a1f3d981b86cf8b381ba5d774ad0b7a2bb8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
f4189b76e0f5f3c197fac1b11c9f95cc

SHA1
1fb3ec864b3242b2fee192b05b7bad20230ba372

SHA256
aa068448724643454768e97748ed7d87c385ac90e27cb1de82bd967b19004012

SHA512
98568d4ac9649778a68ea40e7406ede970fb2a1cd5576d64dde1d1adde84c80ee26e5f8589d4b3af4cab6eb9ab776ece329a39b9d78095cc9ed0d4f570ebca24

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e074253b7e3f36d14c50da9757aec9b9

SHA1
059fb12928e55e1b1283dc93bd8e5631b7069224

SHA256
b07d444b1839b57d4f011ef212f5932e0b5af51c662ece45e37a8520d71d6582

SHA512
cf335e3629813cdfe6270712cef620f795e523ddc28ba555480a34e6bf3faf42cc0cf624f5ee917cc65b0d08a721f2a4d2832049fe61422a2505b09ef7d7db36

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
a1ba7703972b944f80457568e342ea46

SHA1
73ff7f896b756cc66eab3dd549e029408ae5b12b

SHA256
0c965a2d8dd9953f5241e79f8707361a3e1d49e0292c44006b99ac1a14e4139a

SHA512
ca9dae5cf0c7d129ec2412419703d5452496abaa94159b1bfff8c6749ce9de573eb04516e93d8d323ccd28e2ad9d33b89adc515395c08726603ffd8ac8ec61df

Download Submit
memory/1708-265-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-179-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-264-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-57-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-1-0x0000000003360000-0x000000000375E000-memory.dmp

Filesize
4.0MB

Download
memory/1708-21-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-3-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-2-0x0000000005100000-0x00000000059EB000-memory.dmp

Filesize
8.9MB

Download
memory/1708-49-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-32-0x0000000005100000-0x00000000059EB000-memory.dmp

Filesize
8.9MB

Download
memory/1708-230-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/1708-29-0x0000000003360000-0x000000000375E000-memory.dmp

Filesize
4.0MB

Download
memory/4384-90-0x0000000007D40000-0x0000000007D51000-memory.dmp

Filesize
68KB

Download
memory/4384-89-0x0000000007A40000-0x0000000007AE3000-memory.dmp

Filesize
652KB

Download
memory/4384-91-0x0000000007D90000-0x0000000007DA4000-memory.dmp

Filesize
80KB

Download
memory/4384-79-0x0000000070550000-0x00000000708A4000-memory.dmp

Filesize
3.3MB

Download
memory/4384-78-0x00000000703D0000-0x000000007041C000-memory.dmp

Filesize
304KB

Download
memory/4384-77-0x000000007F4B0000-0x000000007F4C0000-memory.dmp

Filesize
64KB

Download
memory/4384-76-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4384-74-0x0000000006830000-0x000000000687C000-memory.dmp

Filesize
304KB

Download
memory/4384-73-0x0000000006350000-0x00000000066A4000-memory.dmp

Filesize
3.3MB

Download
memory/4384-63-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4384-62-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4384-94-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/4384-61-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/4468-31-0x00000000702D0000-0x000000007031C000-memory.dmp

Filesize
304KB

Download
memory/4468-23-0x0000000006540000-0x000000000658C000-memory.dmp

Filesize
304KB

Download
memory/4468-56-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/4468-52-0x00000000077E0000-0x00000000077FA000-memory.dmp

Filesize
104KB

Download
memory/4468-4-0x00000000049E0000-0x0000000004A16000-memory.dmp

Filesize
216KB

Download
memory/4468-5-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/4468-51-0x00000000076F0000-0x0000000007704000-memory.dmp

Filesize
80KB

Download
memory/4468-50-0x00000000076E0000-0x00000000076EE000-memory.dmp

Filesize
56KB

Download
memory/4468-48-0x00000000076A0000-0x00000000076B1000-memory.dmp

Filesize
68KB

Download
memory/4468-47-0x0000000007740000-0x00000000077D6000-memory.dmp

Filesize
600KB

Download
memory/4468-46-0x0000000007680000-0x000000000768A000-memory.dmp

Filesize
40KB

Download
memory/4468-6-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4468-45-0x0000000007570000-0x0000000007613000-memory.dmp

Filesize
652KB

Download
memory/4468-44-0x0000000006270000-0x000000000628E000-memory.dmp

Filesize
120KB

Download
memory/4468-34-0x0000000070450000-0x00000000707A4000-memory.dmp

Filesize
3.3MB

Download
memory/4468-33-0x000000007F320000-0x000000007F330000-memory.dmp

Filesize
64KB

Download
memory/4468-30-0x0000000007530000-0x0000000007562000-memory.dmp

Filesize
200KB

Download
memory/4468-28-0x0000000007370000-0x000000000738A000-memory.dmp

Filesize
104KB

Download
memory/4468-27-0x00000000079D0000-0x000000000804A000-memory.dmp

Filesize
6.5MB

Download
memory/4468-26-0x00000000072D0000-0x0000000007346000-memory.dmp

Filesize
472KB

Download
memory/4468-25-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4468-7-0x00000000051C0000-0x00000000057E8000-memory.dmp

Filesize
6.2MB

Download
memory/4468-8-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Filesize
136KB

Download
memory/4468-9-0x0000000005150000-0x00000000051B6000-memory.dmp

Filesize
408KB

Download
memory/4468-10-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/4468-20-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4468-24-0x00000000064A0000-0x00000000064E4000-memory.dmp

Filesize
272KB

Download
memory/4468-22-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Filesize
120KB

Download
memory/4468-53-0x0000000007730000-0x0000000007738000-memory.dmp

Filesize
32KB

Download
memory/4488-142-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/4488-137-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/4488-139-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/4488-138-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/4884-136-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-111-0x0000000003460000-0x000000000385F000-memory.dmp

Filesize
4.0MB

Download
memory/4884-159-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-59-0x0000000003460000-0x000000000385F000-memory.dmp

Filesize
4.0MB

Download
memory/4884-60-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-141-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-75-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/4884-97-0x0000000000400000-0x0000000003009000-memory.dmp

Filesize
44.0MB

Download
memory/5116-109-0x0000000006300000-0x0000000006654000-memory.dmp

Filesize
3.3MB

Download
memory/5116-126-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/5116-99-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/5116-98-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/5116-114-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

Filesize
64KB

Download
memory/5116-96-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/5116-115-0x0000000070B70000-0x0000000070EC4000-memory.dmp

Filesize
3.3MB

Download
memory/5116-112-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/5116-113-0x00000000703D0000-0x000000007041C000-memory.dmp

Filesize
304KB

Download