glupteba | accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Size

4.2MB
MD5

fa4f154cb06c1b9fb3123fe0c2587f78
SHA1

b814221815fff6a43f290b048b2b9d217b398c25
SHA256

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8
SHA512

e7bccaf9ca606654bb1879a0358eb6e9181eb5811184a72c134dcb250ea1753f2054668a1f57e253429672ef84cc9f9bf67bb27bd9997cd753af86847963f716
SSDEEP

98304:500QK3N3Jc8wpX9Ml+P+WnP01raAvqFLRTemOJzdkXGt:7pJcNpX++PyaASVpB6ko

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5316-2-0x0000000003FE0000-0x00000000048CB000-memory.dmp	family_glupteba
behavioral2/memory/5316-3-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1792-55-0x0000000003F50000-0x000000000483B000-memory.dmp	family_glupteba
behavioral2/memory/5316-54-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1792-56-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1792-128-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1792-147-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-241-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-250-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-251-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-254-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-256-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-258-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-260-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-262-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-263-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-266-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-268-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-270-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral2/memory/1116-272-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1448 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

1116 csrss.exe
1952 injector.exe
3744 windefender.exe
5308 windefender.exe

pid	process
1448	netsh.exe

pid	process
1116	csrss.exe
1952	injector.exe
3744	windefender.exe
5308	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3744-249-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5308-252-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5308-255-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

Drops file in Windows directory 4 IoCs

Processes:

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
File created	C:\Windows\rss\csrss.exe	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2748 sc.exe

pid	process
2748	sc.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1164	5316	WerFault.exe	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1588	1792	WerFault.exe	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3404 schtasks.exe
1208 schtasks.exe

pid	process
3404	schtasks.exe
1208	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewindefender.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exepowershell.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
3008	powershell.exe
3008	powershell.exe
5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
780	powershell.exe
780	powershell.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
232	powershell.exe
232	powershell.exe
5764	powershell.exe
5764	powershell.exe
1312	powershell.exe
1312	powershell.exe
5980	powershell.exe
5980	powershell.exe
5444	powershell.exe
5444	powershell.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1116	csrss.exe
1116	csrss.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1116	csrss.exe
1116	csrss.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1116	csrss.exe
1116	csrss.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe
1952	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Token: SeImpersonatePrivilege	5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeSystemEnvironmentPrivilege	1116	csrss.exe
Token: SeSecurityPrivilege	2748	sc.exe
Token: SeSecurityPrivilege	2748	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exeaccda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 5316 wrote to memory of 3008	5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 5316 wrote to memory of 3008	5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 5316 wrote to memory of 3008	5316	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 780	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 780	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 780	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 5680	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	cmd.exe
PID 1792 wrote to memory of 5680	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	cmd.exe
PID 5680 wrote to memory of 1448	5680	cmd.exe	netsh.exe
PID 5680 wrote to memory of 1448	5680	cmd.exe	netsh.exe
PID 1792 wrote to memory of 232	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 232	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 232	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 5764	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 5764	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 5764	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	powershell.exe
PID 1792 wrote to memory of 1116	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	csrss.exe
PID 1792 wrote to memory of 1116	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	csrss.exe
PID 1792 wrote to memory of 1116	1792	accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe	csrss.exe
PID 1116 wrote to memory of 1312	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 1312	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 1312	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5980	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5980	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5980	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5444	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5444	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 5444	1116	csrss.exe	powershell.exe
PID 1116 wrote to memory of 1952	1116	csrss.exe	injector.exe
PID 1116 wrote to memory of 1952	1116	csrss.exe	injector.exe
PID 3744 wrote to memory of 5736	3744	windefender.exe	cmd.exe
PID 3744 wrote to memory of 5736	3744	windefender.exe	cmd.exe
PID 3744 wrote to memory of 5736	3744	windefender.exe	cmd.exe
PID 5736 wrote to memory of 2748	5736	cmd.exe	sc.exe
PID 5736 wrote to memory of 2748	5736	cmd.exe	sc.exe
PID 5736 wrote to memory of 2748	5736	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe
"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:5680

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:1448

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3404

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:2792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1208

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:5736

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 892
3⤵
- Program crash
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 716
2⤵
- Program crash
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5316 -ip 5316
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1792 -ip 1792
1⤵
PID:3824

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lqolk1bw.adb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
8f0f715a98d83a6340f3037eb2a42115

SHA1
0a940a65c15d356e72378e7ff5c9af4d0fc10522

SHA256
3ff0177a8976cdb9c066627580f7466e61c3b87ac995289d20c3b04bcf873dd4

SHA512
f14f28e6a3d2dcfcc5e67d13c0c9eeabaf9f7c50b6ba4a67cc913f706e49c61a338ff3b0074a99fe3bb9a447c1e65a3a4bc1d0fa22f704dbbb77f37d6e858413

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
c53829c11394b94aa072d440a3328a6d

SHA1
0ce08c3317aceef73428db0d1831e995a5d5694a

SHA256
1f616107955e79edbb72765245096f9ed1716c3e2adf268f28d5b07387cbc56b

SHA512
3da1d1e788cf15509bc38486e5316fee961ce60c7b70d414a462bae1180e3d62cb2e0148af325a55f8f56ed2b8a2e0a121f0a198483731bedfb4363436d3e61c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
912002784d96d2f4de88c163fdb24ab3

SHA1
670f0966fec13c5a3c01c4e2f3327dd56c340504

SHA256
e1234b63335d59ec2108abe8f1c3043124bf3c2585674308161a8cdfc6170dff

SHA512
6155f88e34aedd9377827391971748daba8d4b2ce57e00132ab179068e16c84173857289ee15228ede0598d4cf8ce22c7308f5770fdc58bf227493b38b1246e5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
f1bbfd895a4d2a5c01713566fb33454d

SHA1
e6132338dd7127e60fe6c43f93c78332af1e7f62

SHA256
2383482fd156c656c4d6867d3df8cc0a9d577e8c4a629084710aab7b80f7d4bd

SHA512
6bec164e53074aae59b871b8806246fd64bddc6b633794bf025d4b56caef592a6462f25ca446028e4cb2a4e64ecb10711a3a381aec66d3d437e362baf9b050c8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e2e11a1637407f2d1983fcf486eeaf0a

SHA1
d49136788e3db639dcb28d1d29727548ff2cdaf8

SHA256
a6fe7af34c37a6707cc201a213bdc15afbadfcb24dae07f2804d6addeadb692c

SHA512
9def9adceebbe4e409d84a0089509f20ea6d221345a8a4e96a589786803521b63074426e4f27a64062fae93f577b31d3a32f48f0753f82f60312d75e2ba7aa3e

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
fa4f154cb06c1b9fb3123fe0c2587f78

SHA1
b814221815fff6a43f290b048b2b9d217b398c25

SHA256
accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8

SHA512
e7bccaf9ca606654bb1879a0358eb6e9181eb5811184a72c134dcb250ea1753f2054668a1f57e253429672ef84cc9f9bf67bb27bd9997cd753af86847963f716

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/232-113-0x0000000074620000-0x0000000074DD1000-memory.dmp

Filesize
7.7MB

Download
memory/232-88-0x0000000074620000-0x0000000074DD1000-memory.dmp

Filesize
7.7MB

Download
memory/232-89-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/232-98-0x0000000006370000-0x00000000066C7000-memory.dmp

Filesize
3.3MB

Download
memory/232-102-0x0000000070A80000-0x0000000070DD7000-memory.dmp

Filesize
3.3MB

Download
memory/232-101-0x0000000070900000-0x000000007094C000-memory.dmp

Filesize
304KB

Download
memory/232-100-0x000000007F470000-0x000000007F480000-memory.dmp

Filesize
64KB

Download
memory/780-82-0x0000000006F40000-0x0000000006F51000-memory.dmp

Filesize
68KB

Download
memory/780-86-0x0000000074620000-0x0000000074DD1000-memory.dmp

Filesize
7.7MB

Download
memory/780-68-0x00000000054C0000-0x0000000005817000-memory.dmp

Filesize
3.3MB

Download
memory/780-69-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Filesize
304KB

Download
memory/780-59-0x00000000045B0000-0x00000000045C0000-memory.dmp

Filesize
64KB

Download
memory/780-58-0x00000000045B0000-0x00000000045C0000-memory.dmp

Filesize
64KB

Download
memory/780-57-0x0000000074620000-0x0000000074DD1000-memory.dmp

Filesize
7.7MB

Download
memory/780-71-0x0000000070900000-0x000000007094C000-memory.dmp

Filesize
304KB

Download
memory/780-72-0x0000000070B10000-0x0000000070E67000-memory.dmp

Filesize
3.3MB

Download
memory/780-70-0x000000007F550000-0x000000007F560000-memory.dmp

Filesize
64KB

Download
memory/780-81-0x0000000006C20000-0x0000000006CC4000-memory.dmp

Filesize
656KB

Download
memory/780-83-0x0000000006F90000-0x0000000006FA5000-memory.dmp

Filesize
84KB

Download
memory/1116-241-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-272-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-254-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-258-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-256-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-251-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-270-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-250-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-263-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-260-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-262-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-268-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1116-266-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1792-147-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1792-111-0x0000000003B40000-0x0000000003F48000-memory.dmp

Filesize
4.0MB

Download
memory/1792-56-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1792-55-0x0000000003F50000-0x000000000483B000-memory.dmp

Filesize
8.9MB

Download
memory/1792-128-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1792-52-0x0000000003B40000-0x0000000003F48000-memory.dmp

Filesize
4.0MB

Download
memory/3008-20-0x0000000005A20000-0x0000000005D77000-memory.dmp

Filesize
3.3MB

Download
memory/3008-45-0x00000000075C0000-0x00000000075D5000-memory.dmp

Filesize
84KB

Download
memory/3008-46-0x0000000007610000-0x000000000762A000-memory.dmp

Filesize
104KB

Download
memory/3008-36-0x00000000073B0000-0x00000000073CE000-memory.dmp

Filesize
120KB

Download
memory/3008-44-0x00000000075B0000-0x00000000075BE000-memory.dmp

Filesize
56KB

Download
memory/3008-43-0x0000000007560000-0x0000000007571000-memory.dmp

Filesize
68KB

Download
memory/3008-42-0x0000000007650000-0x00000000076E6000-memory.dmp

Filesize
600KB

Download
memory/3008-41-0x0000000007540000-0x000000000754A000-memory.dmp

Filesize
40KB

Download
memory/3008-40-0x0000000007500000-0x000000000751A000-memory.dmp

Filesize
104KB

Download
memory/3008-39-0x0000000007B40000-0x00000000081BA000-memory.dmp

Filesize
6.5MB

Download
memory/3008-4-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Filesize
216KB

Download
memory/3008-38-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Filesize
64KB

Download
memory/3008-7-0x00000000051E0000-0x000000000580A000-memory.dmp

Filesize
6.2MB

Download
memory/3008-8-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Filesize
64KB

Download
memory/3008-6-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Filesize
64KB

Download
memory/3008-37-0x00000000073D0000-0x0000000007474000-memory.dmp

Filesize
656KB

Download
memory/3008-5-0x0000000074580000-0x0000000074D31000-memory.dmp

Filesize
7.7MB

Download
memory/3008-9-0x0000000005080000-0x00000000050A2000-memory.dmp

Filesize
136KB

Download
memory/3008-10-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/3008-11-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/3008-50-0x0000000074580000-0x0000000074D31000-memory.dmp

Filesize
7.7MB

Download
memory/3008-47-0x0000000007630000-0x0000000007638000-memory.dmp

Filesize
32KB

Download
memory/3008-21-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/3008-27-0x0000000070970000-0x0000000070CC7000-memory.dmp

Filesize
3.3MB

Download
memory/3008-26-0x00000000707F0000-0x000000007083C000-memory.dmp

Filesize
304KB

Download
memory/3008-25-0x0000000007170000-0x00000000071A4000-memory.dmp

Filesize
208KB

Download
memory/3008-24-0x000000007F4B0000-0x000000007F4C0000-memory.dmp

Filesize
64KB

Download
memory/3008-23-0x00000000064C0000-0x0000000006506000-memory.dmp

Filesize
280KB

Download
memory/3008-22-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Filesize
304KB

Download
memory/3744-249-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5308-255-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5308-252-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5316-1-0x0000000003BD0000-0x0000000003FD5000-memory.dmp

Filesize
4.0MB

Download
memory/5316-2-0x0000000003FE0000-0x00000000048CB000-memory.dmp

Filesize
8.9MB

Download
memory/5316-54-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/5316-53-0x0000000003BD0000-0x0000000003FD5000-memory.dmp

Filesize
4.0MB

Download
memory/5316-3-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/5764-127-0x0000000070B50000-0x0000000070EA7000-memory.dmp

Filesize
3.3MB

Download
memory/5764-124-0x00000000063B0000-0x0000000006707000-memory.dmp

Filesize
3.3MB

Download
memory/5764-115-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/5764-126-0x0000000070900000-0x000000007094C000-memory.dmp

Filesize
304KB

Download
memory/5764-138-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/5764-137-0x000000007F0E0000-0x000000007F0F0000-memory.dmp

Filesize
64KB

Download
memory/5764-114-0x0000000074620000-0x0000000074DD1000-memory.dmp

Filesize
7.7MB

Download