glupteba | 65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Size

4.2MB
MD5

aaf32430b1db20419ee11a21f9fff012
SHA1

c88cc08c0c5b4c03f259b520074fbf190c2b3377
SHA256

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98
SHA512

2d6836f289a3c759917901e62bcdf8a763537a0ac627a447921209211471ba4d9a51ca64c005c213dcfcb3b324413e48896b55fe0ccd946f02f5ddd94bfb382d
SSDEEP

98304:9IBNXOOfwLGhP6KRoj027D5HGyNAiNcOh9MZ99WifgA28ff94Zz:Ejfa7j0YDNAHCC9Miz28ffM

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1092-2-0x0000000005110000-0x00000000059FB000-memory.dmp	family_glupteba
behavioral1/memory/1092-3-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/5768-56-0x00000000051A0000-0x0000000005A8B000-memory.dmp	family_glupteba
behavioral1/memory/5768-58-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/1092-69-0x0000000005110000-0x00000000059FB000-memory.dmp	family_glupteba
behavioral1/memory/1092-73-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/5768-237-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-260-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-271-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-275-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-279-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-283-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-287-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-291-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-295-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-299-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-303-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-307-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-311-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba
behavioral1/memory/4168-315-0x0000000000400000-0x0000000003111000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4728 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4168 csrss.exe
3736 injector.exe
4480 windefender.exe
2236 windefender.exe

pid	process
4728	netsh.exe

pid	process
4168	csrss.exe
3736	injector.exe
4480	windefender.exe
2236	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/4480-269-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2236-273-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2236-281-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exe65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe

description	ioc	process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
File created	C:\Windows\rss\csrss.exe	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2004 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4572 schtasks.exe
5580 schtasks.exe

pid	process
2004	sc.exe

pid	process
4572	schtasks.exe
5580	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exepowershell.exe65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
3436	powershell.exe
3436	powershell.exe
1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
2352	powershell.exe
2352	powershell.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
3388	powershell.exe
3388	powershell.exe
4512	powershell.exe
4512	powershell.exe
5480	powershell.exe
5480	powershell.exe
6068	powershell.exe
6068	powershell.exe
2148	powershell.exe
2148	powershell.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
4168	csrss.exe
4168	csrss.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
4168	csrss.exe
4168	csrss.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
4168	csrss.exe
4168	csrss.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe
3736	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Token: SeImpersonatePrivilege	1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4168	csrss.exe
Token: SeSecurityPrivilege	2004	sc.exe
Token: SeSecurityPrivilege	2004	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 1092 wrote to memory of 3436	1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 1092 wrote to memory of 3436	1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 1092 wrote to memory of 3436	1092	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 2352	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 2352	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 2352	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 5440	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	cmd.exe
PID 5768 wrote to memory of 5440	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	cmd.exe
PID 5440 wrote to memory of 4728	5440	cmd.exe	netsh.exe
PID 5440 wrote to memory of 4728	5440	cmd.exe	netsh.exe
PID 5768 wrote to memory of 3388	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 3388	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 3388	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 4512	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 4512	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 4512	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	powershell.exe
PID 5768 wrote to memory of 4168	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	csrss.exe
PID 5768 wrote to memory of 4168	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	csrss.exe
PID 5768 wrote to memory of 4168	5768	65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe	csrss.exe
PID 4168 wrote to memory of 5480	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 5480	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 5480	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 6068	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 6068	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 6068	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 2148	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 2148	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 2148	4168	csrss.exe	powershell.exe
PID 4168 wrote to memory of 3736	4168	csrss.exe	injector.exe
PID 4168 wrote to memory of 3736	4168	csrss.exe	injector.exe
PID 4480 wrote to memory of 3684	4480	windefender.exe	cmd.exe
PID 4480 wrote to memory of 3684	4480	windefender.exe	cmd.exe
PID 4480 wrote to memory of 3684	4480	windefender.exe	cmd.exe
PID 3684 wrote to memory of 2004	3684	cmd.exe	sc.exe
PID 3684 wrote to memory of 2004	3684	cmd.exe	sc.exe
PID 3684 wrote to memory of 2004	3684	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
"C:\Users\Admin\AppData\Local\Temp\65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Users\Admin\AppData\Local\Temp\65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe
"C:\Users\Admin\AppData\Local\Temp\65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5768

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:5440

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4572

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3736

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:5580

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwbajkkb.124.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
19c4f78970465be8c06f6b53a4dc0e92

SHA1
1a18abe1d7b70fc2c1907aed2308009ceeef98c4

SHA256
c0b317332601b03b8837b51a0837326cf6f0aea0f1279386690ebf230377410a

SHA512
e04db4f85a7078f9c13d570eeab9b37bc3c45db03019c08c706f4b533b265c0d4538fc971ad5306beb59c40d40572a749e29361381bedc837916f4a3bae70b04

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
a6dc4068a9e470a54e304260052dba80

SHA1
01710be651376027b3b695f4d52143317d8d65b0

SHA256
4d3ac289c162b30cb43aed6716d5ff6d6f264496a2a9c7e361f2ea283b46adc0

SHA512
f1c957ed20e20f627858978c47ea7b145b0b560e9333c9152ee536c039e1af77b37cb3a0b9784e3f5d4eebb24ca7c35c5dc64358e48f29a67fba1b6fe727a8b9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
766547e4a828b5894775ad1bdeab9d81

SHA1
5669f456f31801e96ed20b90a6760c889612edcb

SHA256
d829d55705befa86a1ed028365a0491d99aa81756809894cdaa5d54c42b8b7e8

SHA512
089fa26405fdc7fe104232cbb231c8d6aa83fcab714d14b1ba71750a914afb7b2164555dc5285715499a1ab31533cb1e6af5ed3ec046aeb8a6fdf4c713d32043

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
872fd41dee1df0e70b08341573ffc954

SHA1
3d33a23bebb4f6cdd30b5b8e92403058da316543

SHA256
c445f168f7b539bd0c5a63296f0d9a5d7cfef49f3ec9e536b6db31ffdd152a56

SHA512
14a5bff8b909b4ff366d4827e07be35d9ca9c055a49a043caa3aa664f4658e01993f0358d83b82775de2d0de21ea90dfffabef4b33bce19c2910eb651c23762a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
31f01d54f27a05c5cecaa8d21e092f00

SHA1
5741ba89db191f56aee9de47cb219bf0bac360f5

SHA256
734421dec235cce4a97ead1e6ba120c773296a2354fe7ca3bb174bdf2203104d

SHA512
296166df6f7e377c3b15359351cb0998b88adcbbba88860870aaf1b5107897eaac47e4f400c6fcd82915ae377a756c2ed7e2f63ab1682af5c4b962e6dfa04121

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
aaf32430b1db20419ee11a21f9fff012

SHA1
c88cc08c0c5b4c03f259b520074fbf190c2b3377

SHA256
65a937f2d1bf1f5592db03fb9369961c43e78b04cc71f3038dbc353e01abff98

SHA512
2d6836f289a3c759917901e62bcdf8a763537a0ac627a447921209211471ba4d9a51ca64c005c213dcfcb3b324413e48896b55fe0ccd946f02f5ddd94bfb382d

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1092-3-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/1092-69-0x0000000005110000-0x00000000059FB000-memory.dmp

Filesize
8.9MB

Download
memory/1092-57-0x0000000004D10000-0x0000000005110000-memory.dmp

Filesize
4.0MB

Download
memory/1092-73-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/1092-2-0x0000000005110000-0x00000000059FB000-memory.dmp

Filesize
8.9MB

Download
memory/1092-1-0x0000000004D10000-0x0000000005110000-memory.dmp

Filesize
4.0MB

Download
memory/2236-273-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2236-281-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2352-88-0x00000000072E0000-0x00000000072F1000-memory.dmp

Filesize
68KB

Download
memory/2352-72-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2352-68-0x0000000005760000-0x0000000005AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2352-71-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/2352-74-0x0000000070540000-0x000000007058C000-memory.dmp

Filesize
304KB

Download
memory/2352-75-0x0000000070CF0000-0x0000000071044000-memory.dmp

Filesize
3.3MB

Download
memory/2352-87-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/2352-92-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2352-89-0x0000000007330000-0x0000000007344000-memory.dmp

Filesize
80KB

Download
memory/2352-70-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/2352-85-0x0000000006FB0000-0x0000000007053000-memory.dmp

Filesize
652KB

Download
memory/2352-86-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/3388-119-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/3388-94-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/3388-109-0x00000000706C0000-0x0000000070A14000-memory.dmp

Filesize
3.3MB

Download
memory/3388-120-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/3388-95-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/3388-96-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/3388-107-0x000000007F730000-0x000000007F740000-memory.dmp

Filesize
64KB

Download
memory/3388-122-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/3388-108-0x0000000070540000-0x000000007058C000-memory.dmp

Filesize
304KB

Download
memory/3436-31-0x00000000706C0000-0x0000000070A14000-memory.dmp

Filesize
3.3MB

Download
memory/3436-30-0x0000000070540000-0x000000007058C000-memory.dmp

Filesize
304KB

Download
memory/3436-5-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/3436-4-0x0000000005120000-0x0000000005156000-memory.dmp

Filesize
216KB

Download
memory/3436-53-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/3436-50-0x0000000007E20000-0x0000000007E28000-memory.dmp

Filesize
32KB

Download
memory/3436-49-0x0000000007E30000-0x0000000007E4A000-memory.dmp

Filesize
104KB

Download
memory/3436-48-0x0000000007DE0000-0x0000000007DF4000-memory.dmp

Filesize
80KB

Download
memory/3436-47-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

Filesize
56KB

Download
memory/3436-46-0x0000000007D80000-0x0000000007D91000-memory.dmp

Filesize
68KB

Download
memory/3436-45-0x0000000007E80000-0x0000000007F16000-memory.dmp

Filesize
600KB

Download
memory/3436-44-0x0000000007D70000-0x0000000007D7A000-memory.dmp

Filesize
40KB

Download
memory/3436-41-0x0000000007C60000-0x0000000007C7E000-memory.dmp

Filesize
120KB

Download
memory/3436-43-0x0000000007C80000-0x0000000007D23000-memory.dmp

Filesize
652KB

Download
memory/3436-42-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/3436-10-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/3436-28-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

Filesize
64KB

Download
memory/3436-29-0x0000000007C00000-0x0000000007C32000-memory.dmp

Filesize
200KB

Download
memory/3436-26-0x00000000080A0000-0x000000000871A000-memory.dmp

Filesize
6.5MB

Download
memory/3436-27-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/3436-25-0x00000000077A0000-0x0000000007816000-memory.dmp

Filesize
472KB

Download
memory/3436-24-0x0000000006BE0000-0x0000000006C24000-memory.dmp

Filesize
272KB

Download
memory/3436-23-0x00000000066C0000-0x000000000670C000-memory.dmp

Filesize
304KB

Download
memory/3436-22-0x00000000066A0000-0x00000000066BE000-memory.dmp

Filesize
120KB

Download
memory/3436-6-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/3436-8-0x0000000005790000-0x0000000005DB8000-memory.dmp

Filesize
6.2MB

Download
memory/3436-7-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/3436-9-0x00000000056C0000-0x00000000056E2000-memory.dmp

Filesize
136KB

Download
memory/3436-21-0x0000000006090000-0x00000000063E4000-memory.dmp

Filesize
3.3MB

Download
memory/3436-11-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/4168-271-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-295-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-315-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-311-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-307-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-260-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-303-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-299-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-291-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-287-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-275-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-279-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4168-283-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/4480-269-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4512-123-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/4512-131-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/4512-127-0x0000000005880000-0x0000000005BD4000-memory.dmp

Filesize
3.3MB

Download
memory/5768-56-0x00000000051A0000-0x0000000005A8B000-memory.dmp

Filesize
8.9MB

Download
memory/5768-55-0x0000000004DA0000-0x00000000051A0000-memory.dmp

Filesize
4.0MB

Download
memory/5768-58-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download
memory/5768-124-0x0000000004DA0000-0x00000000051A0000-memory.dmp

Filesize
4.0MB

Download
memory/5768-237-0x0000000000400000-0x0000000003111000-memory.dmp

Filesize
45.1MB

Download