glupteba | 26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a

Analysis

max time kernel
153s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Size

4.2MB
MD5

a37f7b3fac61ef0428718cefdf8eba41
SHA1

0906f81cce2ee452fcbadec597c8b44b6e3eb5e3
SHA256

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a
SHA512

6a4d6e05f9ed3eead82299c967ac5084ded94da2bb72d92028edfd9bc8a9c7ac2d780fc8e106b3d125363db24d672324d8f570364f1aeed5e0231cccd6ec6aaf
SSDEEP

98304:PNkDk7Y2e9fhWY+LbgLFpBVAayCN/CB0J4dlv7S/k29jp/46:Wk7LeNhW/+FpBVAa19Ce4dlv7wZ46

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2220-2-0x0000000005360000-0x0000000005C4B000-memory.dmp	family_glupteba
behavioral2/memory/2220-3-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/2220-25-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-55-0x0000000005220000-0x0000000005B0B000-memory.dmp	family_glupteba
behavioral2/memory/812-56-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/2220-57-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-70-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-104-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-105-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-133-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/812-151-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-212-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-245-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-255-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-257-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-260-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-263-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-266-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-269-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral2/memory/572-272-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1576 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

572 csrss.exe
4292 injector.exe
4024 windefender.exe
2568 windefender.exe

pid	process
1576	netsh.exe

pid	process
572	csrss.exe
4292	injector.exe
4024	windefender.exe
2568	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/4024-254-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2568-258-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2568-264-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1734202354-1504186683-2192872036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1734202354-1504186683-2192872036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe

Drops file in Windows directory 4 IoCs

Processes:

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
File created	C:\Windows\rss\csrss.exe	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4948 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2796 schtasks.exe
1136 schtasks.exe

pid	process
4948	sc.exe

pid	process
2796	schtasks.exe
1136	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exepowershell.exe26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
3876	powershell.exe
3876	powershell.exe
2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
1528	powershell.exe
1528	powershell.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
3292	powershell.exe
3292	powershell.exe
796	powershell.exe
796	powershell.exe
4936	powershell.exe
4936	powershell.exe
1300	powershell.exe
1300	powershell.exe
2936	powershell.exe
2936	powershell.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
572	csrss.exe
572	csrss.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
572	csrss.exe
572	csrss.exe
4292	injector.exe
4292	injector.exe
572	csrss.exe
572	csrss.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe
4292	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Token: SeImpersonatePrivilege	2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeSystemEnvironmentPrivilege	572	csrss.exe
Token: SeSecurityPrivilege	4948	sc.exe
Token: SeSecurityPrivilege	4948	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 2220 wrote to memory of 3876	2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 2220 wrote to memory of 3876	2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 2220 wrote to memory of 3876	2220	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 1528	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 1528	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 1528	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 4556	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	cmd.exe
PID 812 wrote to memory of 4556	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	cmd.exe
PID 4556 wrote to memory of 1576	4556	cmd.exe	netsh.exe
PID 4556 wrote to memory of 1576	4556	cmd.exe	netsh.exe
PID 812 wrote to memory of 3292	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 3292	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 3292	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 796	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 796	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 796	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	powershell.exe
PID 812 wrote to memory of 572	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	csrss.exe
PID 812 wrote to memory of 572	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	csrss.exe
PID 812 wrote to memory of 572	812	26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe	csrss.exe
PID 572 wrote to memory of 4936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 4936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 4936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 1300	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 1300	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 1300	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 2936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 2936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 2936	572	csrss.exe	powershell.exe
PID 572 wrote to memory of 4292	572	csrss.exe	injector.exe
PID 572 wrote to memory of 4292	572	csrss.exe	injector.exe
PID 4024 wrote to memory of 4440	4024	windefender.exe	cmd.exe
PID 4024 wrote to memory of 4440	4024	windefender.exe	cmd.exe
PID 4024 wrote to memory of 4440	4024	windefender.exe	cmd.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	sc.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	sc.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
"C:\Users\Admin\AppData\Local\Temp\26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Users\Admin\AppData\Local\Temp\26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe
"C:\Users\Admin\AppData\Local\Temp\26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:1576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2796

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1136

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2xvmnfb.iti.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
a37aa728ee4a6a4f68e7e58fd6dcaa54

SHA1
88e3b846181e4d22b787fadd7cc0b5804480e4f2

SHA256
e4c0ffbd68db812b6bcf8d94f7242e0bcc6d9c7f8210b2b24cfb6613b446a9a7

SHA512
a1b82f24aa0cdfc5df8a863ed5ba5af4819fd263c4b42490e9d11b7852403cf054db4c3f120eaa11de4eec9b79fec61f63b13bf5b1e38efeca73ee21d49fd399

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
141a49119b59ee9262091505fe32d33f

SHA1
6e4daf83b27f579894c1346135712b2e37053412

SHA256
dd582955fba87944de51f60d1ac8e5ee1b805f8987ef0d1592d0cfcbecd3de53

SHA512
0048439ffd7df18de5d72973471aab85745079a738d8ac0f42a061db304e4cad0beb2b84ff1467eb8b24d3f2bcd8c1906fd53441026e6607bc4179ba8f8ad04b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
54f9f36b5c5d394b4db370b3226d2840

SHA1
4ec8a91425670e69338a3cc7db9d18a1637fe126

SHA256
c289f28a329346d2969be70b3ffcac87da61152de7d9fa3b43d4decf3179a699

SHA512
c15d7d1779dbdb8aa71f6380e26fd2ce174ef99a851478081f502e6f396d9b60c006d1e5e32a1596f71e3afc8993d88dd737bb430d730efdf09f815dce7f393d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
453e65110f1d6bcb8ecff319da5e1e00

SHA1
54bf665bb29247c29e7b1f17ae59fd27044c519a

SHA256
8926159e6d89f85532c6fdf6104ee99ed6e78178336b25eac4cdb02668c34712

SHA512
34d870043f8c60f387c7b8e434fe6758b8a3f7e3758b7d94c7a10db41fe89e7cdb27e20c8e848bdc87bbbf3459bbaa668fc90b986b173e7a7a28d1795e1586da

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
f7c56c26c5ad2e9d5750349f4915189e

SHA1
04a3b75c980c1667c50e28ee0f1c8d04e10cca30

SHA256
f367b7fe7441dde953a0f19b9d101d0954af7563b62668138a9a484295d8004e

SHA512
94e5a9d3d415993615c4599bcbb66d807d2b89d723f5e05f5ce4a7c09be63a4b9bf210b331b19736553d1f8675ac94afd7abd1dcccee7fb863c3a9387fccb891

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
a37f7b3fac61ef0428718cefdf8eba41

SHA1
0906f81cce2ee452fcbadec597c8b44b6e3eb5e3

SHA256
26e4871ea8517dc503f32d47da1b1d924b56c7f6602ae39e3ce323659dd4051a

SHA512
6a4d6e05f9ed3eead82299c967ac5084ded94da2bb72d92028edfd9bc8a9c7ac2d780fc8e106b3d125363db24d672324d8f570364f1aeed5e0231cccd6ec6aaf

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/572-245-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-255-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-257-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-212-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-260-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-263-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-266-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-269-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/572-272-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/796-130-0x0000000005650000-0x00000000059A7000-memory.dmp

Filesize
3.3MB

Download
memory/796-120-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/796-134-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/796-132-0x0000000004720000-0x0000000004730000-memory.dmp

Filesize
64KB

Download
memory/796-135-0x0000000070E50000-0x00000000711A7000-memory.dmp

Filesize
3.3MB

Download
memory/796-144-0x000000007FCD0000-0x000000007FCE0000-memory.dmp

Filesize
64KB

Download
memory/796-121-0x0000000004720000-0x0000000004730000-memory.dmp

Filesize
64KB

Download
memory/812-133-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-105-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-104-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-103-0x0000000004E20000-0x000000000521E000-memory.dmp

Filesize
4.0MB

Download
memory/812-54-0x0000000004E20000-0x000000000521E000-memory.dmp

Filesize
4.0MB

Download
memory/812-151-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-70-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-56-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/812-55-0x0000000005220000-0x0000000005B0B000-memory.dmp

Filesize
8.9MB

Download
memory/1528-81-0x00000000074F0000-0x0000000007594000-memory.dmp

Filesize
656KB

Download
memory/1528-83-0x0000000007840000-0x0000000007851000-memory.dmp

Filesize
68KB

Download
memory/1528-88-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/1528-84-0x0000000007890000-0x00000000078A5000-memory.dmp

Filesize
84KB

Download
memory/1528-58-0x0000000005D30000-0x0000000006087000-memory.dmp

Filesize
3.3MB

Download
memory/1528-67-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1528-68-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/1528-69-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1528-71-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/1528-72-0x0000000070E30000-0x0000000071187000-memory.dmp

Filesize
3.3MB

Download
memory/1528-82-0x000000007F160000-0x000000007F170000-memory.dmp

Filesize
64KB

Download
memory/2220-53-0x0000000004F60000-0x000000000535C000-memory.dmp

Filesize
4.0MB

Download
memory/2220-2-0x0000000005360000-0x0000000005C4B000-memory.dmp

Filesize
8.9MB

Download
memory/2220-3-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/2220-57-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/2220-25-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/2220-1-0x0000000004F60000-0x000000000535C000-memory.dmp

Filesize
4.0MB

Download
memory/2568-264-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2568-258-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3292-92-0x0000000002D90000-0x0000000002DA0000-memory.dmp

Filesize
64KB

Download
memory/3292-101-0x0000000005D50000-0x00000000060A7000-memory.dmp

Filesize
3.3MB

Download
memory/3292-90-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/3292-91-0x0000000002D90000-0x0000000002DA0000-memory.dmp

Filesize
64KB

Download
memory/3292-116-0x000000007F3B0000-0x000000007F3C0000-memory.dmp

Filesize
64KB

Download
memory/3292-106-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/3292-107-0x0000000070D80000-0x00000000710D7000-memory.dmp

Filesize
3.3MB

Download
memory/3292-119-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/3876-42-0x0000000007070000-0x000000000707A000-memory.dmp

Filesize
40KB

Download
memory/3876-21-0x0000000005A00000-0x0000000005A1E000-memory.dmp

Filesize
120KB

Download
memory/3876-44-0x00000000070A0000-0x00000000070B1000-memory.dmp

Filesize
68KB

Download
memory/3876-41-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/3876-40-0x0000000007680000-0x0000000007CFA000-memory.dmp

Filesize
6.5MB

Download
memory/3876-39-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/3876-45-0x00000000070E0000-0x00000000070EE000-memory.dmp

Filesize
56KB

Download
memory/3876-38-0x0000000006EF0000-0x0000000006F94000-memory.dmp

Filesize
656KB

Download
memory/3876-37-0x0000000006E90000-0x0000000006EAE000-memory.dmp

Filesize
120KB

Download
memory/3876-26-0x0000000006EB0000-0x0000000006EE4000-memory.dmp

Filesize
208KB

Download
memory/3876-28-0x0000000070D60000-0x00000000710B7000-memory.dmp

Filesize
3.3MB

Download
memory/3876-27-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/3876-24-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3876-23-0x0000000005E30000-0x0000000005E76000-memory.dmp

Filesize
280KB

Download
memory/3876-22-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

Filesize
304KB

Download
memory/3876-43-0x0000000007130000-0x00000000071C6000-memory.dmp

Filesize
600KB

Download
memory/3876-20-0x00000000055D0000-0x0000000005927000-memory.dmp

Filesize
3.3MB

Download
memory/3876-11-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Filesize
408KB

Download
memory/3876-10-0x0000000004BD0000-0x0000000004C36000-memory.dmp

Filesize
408KB

Download
memory/3876-9-0x0000000004B30000-0x0000000004B52000-memory.dmp

Filesize
136KB

Download
memory/3876-51-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/3876-7-0x0000000004D10000-0x000000000533A000-memory.dmp

Filesize
6.2MB

Download
memory/3876-8-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3876-46-0x00000000070F0000-0x0000000007105000-memory.dmp

Filesize
84KB

Download
memory/3876-6-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3876-5-0x0000000074970000-0x0000000075121000-memory.dmp

Filesize
7.7MB

Download
memory/3876-47-0x00000000071F0000-0x000000000720A000-memory.dmp

Filesize
104KB

Download
memory/3876-4-0x0000000002200000-0x0000000002236000-memory.dmp

Filesize
216KB

Download
memory/3876-48-0x0000000005D80000-0x0000000005D88000-memory.dmp

Filesize
32KB

Download
memory/4024-254-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download