glupteba | 843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Size

4.2MB
MD5

1c55bf2921a2794845b046dd317ab941
SHA1

558f6c725d67c19fd115e181d558a61deb5e62c3
SHA256

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8
SHA512

aa72e9ae7b77994b42f7d82eee00ca1bbfb8522597bd226c4cee3438d904fb673b6e89348e366e5a86aa452dad38d1f5b64a14bbda01f5fdb1c7459d0825746b
SSDEEP

98304:p00QK3N3Jc8wpX9Ml+P+WnP01raAvqFLRTemOJzdkXGp:rpJcNpX++PyaASVpB6k4

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1300-2-0x00000000041C0000-0x0000000004AAB000-memory.dmp	family_glupteba
behavioral1/memory/1300-3-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/1300-55-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/1300-58-0x00000000041C0000-0x0000000004AAB000-memory.dmp	family_glupteba
behavioral1/memory/4652-59-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4652-158-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-251-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-266-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-279-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-292-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-305-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-318-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-337-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-356-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-375-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-394-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-413-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-432-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3700-456-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2636 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

3700 csrss.exe

pid	process
2636	netsh.exe

pid	process
3700	csrss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4972-265-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3476-278-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3476-304-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

Drops file in Windows directory 2 IoCs

Processes:

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

description	ioc	process
File opened for modification	C:\Windows\rss	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
File created	C:\Windows\rss\csrss.exe	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3204 sc.exe

pid	process
3204	sc.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
620	1300	WerFault.exe	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
3480	4652	WerFault.exe	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2592 schtasks.exe
880 schtasks.exe

pid	process
2592	schtasks.exe
880	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exepowershell.exepowershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exepowershell.exe843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.exe

pid	process
3912	powershell.exe
3912	powershell.exe
1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3168	powershell.exe
3168	powershell.exe
3168	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe
3196	injector.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exe843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Token: SeImpersonatePrivilege	1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeSecurityPrivilege	3204	sc.exe
Token: SeSecurityPrivilege	3204	sc.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.execmd.exewindefender.execmd.exe

description	pid	process	target process
PID 1300 wrote to memory of 3912	1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 1300 wrote to memory of 3912	1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 1300 wrote to memory of 3912	1300	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 2644	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 2644	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 2644	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 4416	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	cmd.exe
PID 4652 wrote to memory of 4416	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	cmd.exe
PID 4416 wrote to memory of 2636	4416	cmd.exe	netsh.exe
PID 4416 wrote to memory of 2636	4416	cmd.exe	netsh.exe
PID 4652 wrote to memory of 3744	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3744	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3744	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3672	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3672	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3672	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	powershell.exe
PID 4652 wrote to memory of 3700	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	csrss.exe
PID 4652 wrote to memory of 3700	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	csrss.exe
PID 4652 wrote to memory of 3700	4652	843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe	csrss.exe
PID 4972 wrote to memory of 4436	4972	windefender.exe	cmd.exe
PID 4972 wrote to memory of 4436	4972	windefender.exe	cmd.exe
PID 4972 wrote to memory of 4436	4972	windefender.exe	cmd.exe
PID 4436 wrote to memory of 3204	4436	cmd.exe	sc.exe
PID 4436 wrote to memory of 3204	4436	cmd.exe	sc.exe
PID 4436 wrote to memory of 3204	4436	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
"C:\Users\Admin\AppData\Local\Temp\843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Users\Admin\AppData\Local\Temp\843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe
"C:\Users\Admin\AppData\Local\Temp\843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2592

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:3104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:880

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 676
3⤵
- Program crash
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 972
2⤵
- Program crash
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1300 -ip 1300
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4652 -ip 4652
1⤵
PID:1420

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Modifies data under HKEY_USERS
PID:3476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkj3dtwe.w2d.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
1fed82c4af93eed919a8ac958f018f1c

SHA1
4a9afe348340016c0436bd38b0e725e78a40a151

SHA256
ef1db35cdeb8eaea9eccbcce025b5452d1ab747d4821726e791b54b8b5a5eea9

SHA512
1e495c00fa73329022ac287c3fbabd79fd33bfb46966fb71eefe309821cab10b75593db1aa53ea50ad8041e0dd3bae8b25bfe993bb14c7110fc67026b0b929a0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
38f9a347b98fa03a6b3d166cc1be8a18

SHA1
d7c28f09a53967f7dc5eecff1f92b07e05a8f5ea

SHA256
cb41ba07a067dc2f7852ddea073f3f5b9ffb6284443ed45a68de9613a887dff8

SHA512
93a54481f87484a1d26c238acc3b97c48965a1e98462b2d4486ad8ca610244375a1cc286b6564109e71ef0786a34dabba937d2bfb6f08e1ff50f2e23be99eaab

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
8572c9cbc43b0fedb31b74dcea57ca67

SHA1
41f55cd5c2dfaff2f81df8a222c1f1ac98eeb740

SHA256
568256e523db5b9e691a25fb725a5d36d93acdec3fa893eced5a74d18c3c84c8

SHA512
23d26ec2de687b99f8cf24346f6eb01cd1137a6b7805fcc662fb240674e33d6fe505efb89949d0c071f52f8638ad42610a376924c3841098e8cfd4f22fe3523a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
fe457388dc1a294789cebc97c8e13100

SHA1
574d46edb370a18eb20cc61aff894a0fff6390ac

SHA256
bd86d4c245649cbbb134d0a3103e164dc1b35557489000e4c184c510c47f2f9d

SHA512
150c57737fa9de84791421cb2869aeae25e80a8072b5d10d5d00607cbfec71aa0dfcc3b03babe92e61e2cf411717979fefd40d5ef0342a13b62ee62916176225

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
63997d7721e457cf665674ac11913ad1

SHA1
f530563169e5aeaea4c5fb14d68f160e3a1cc898

SHA256
6a6e5266fc14622a13674530b8ae7b37c0d2de6b3ab797c789f13ee23b0cc53e

SHA512
a94b97e6abb4c253a051f70ceb62aef1af0c86752e91e7274ec4d0416fa26dca0e711cfdc444a598b207caf3ad953ef8bf9675af70b4951ae56e78757b468f21

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
1c55bf2921a2794845b046dd317ab941

SHA1
558f6c725d67c19fd115e181d558a61deb5e62c3

SHA256
843b947c53c5c2af2469d0ca781468870c0064b2225b4fdecc11e6cc24951ec8

SHA512
aa72e9ae7b77994b42f7d82eee00ca1bbfb8522597bd226c4cee3438d904fb673b6e89348e366e5a86aa452dad38d1f5b64a14bbda01f5fdb1c7459d0825746b

Download Submit
memory/1300-55-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1300-3-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1300-1-0x0000000003DB0000-0x00000000041B8000-memory.dmp

Filesize
4.0MB

Download
memory/1300-2-0x00000000041C0000-0x0000000004AAB000-memory.dmp

Filesize
8.9MB

Download
memory/1300-58-0x00000000041C0000-0x0000000004AAB000-memory.dmp

Filesize
8.9MB

Download
memory/1300-57-0x0000000003DB0000-0x00000000041B8000-memory.dmp

Filesize
4.0MB

Download
memory/2644-75-0x00000000708C0000-0x000000007090C000-memory.dmp

Filesize
304KB

Download
memory/2644-61-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/2644-92-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/2644-89-0x00000000077A0000-0x00000000077B4000-memory.dmp

Filesize
80KB

Download
memory/2644-88-0x0000000007750000-0x0000000007761000-memory.dmp

Filesize
68KB

Download
memory/2644-86-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/2644-87-0x0000000007220000-0x00000000072C3000-memory.dmp

Filesize
652KB

Download
memory/2644-76-0x0000000071060000-0x00000000713B4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-74-0x000000007F040000-0x000000007F050000-memory.dmp

Filesize
64KB

Download
memory/2644-73-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/2644-65-0x0000000005C50000-0x0000000005FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-62-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/2644-60-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3476-304-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3476-278-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3672-125-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3672-127-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/3672-126-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/3700-305-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-356-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-266-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-275-0x00000000750D0000-0x00000000750ED000-memory.dmp

Filesize
116KB

Download
memory/3700-456-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-432-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-413-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-279-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-292-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-394-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-276-0x00000000750C0000-0x00000000750D0000-memory.dmp

Filesize
64KB

Download
memory/3700-318-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-337-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-251-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3700-375-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3744-111-0x0000000070A40000-0x0000000070D94000-memory.dmp

Filesize
3.3MB

Download
memory/3744-109-0x00000000708C0000-0x000000007090C000-memory.dmp

Filesize
304KB

Download
memory/3744-121-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/3744-122-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/3744-124-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-110-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/3744-95-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/3744-94-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-96-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/3744-106-0x0000000005DD0000-0x0000000006124000-memory.dmp

Filesize
3.3MB

Download
memory/3912-23-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Filesize
304KB

Download
memory/3912-50-0x0000000007240000-0x0000000007248000-memory.dmp

Filesize
32KB

Download
memory/3912-25-0x0000000006C00000-0x0000000006C76000-memory.dmp

Filesize
472KB

Download
memory/3912-10-0x0000000004B90000-0x0000000004BF6000-memory.dmp

Filesize
408KB

Download
memory/3912-11-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/3912-26-0x0000000007500000-0x0000000007B7A000-memory.dmp

Filesize
6.5MB

Download
memory/3912-18-0x00000000054B0000-0x0000000005804000-memory.dmp

Filesize
3.3MB

Download
memory/3912-22-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Filesize
120KB

Download
memory/3912-27-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Filesize
104KB

Download
memory/3912-24-0x0000000006040000-0x0000000006084000-memory.dmp

Filesize
272KB

Download
memory/3912-53-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3912-8-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/3912-6-0x0000000004C90000-0x00000000052B8000-memory.dmp

Filesize
6.2MB

Download
memory/3912-29-0x0000000007050000-0x0000000007082000-memory.dmp

Filesize
200KB

Download
memory/3912-7-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/3912-5-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3912-4-0x0000000004500000-0x0000000004536000-memory.dmp

Filesize
216KB

Download
memory/3912-9-0x0000000004AF0000-0x0000000004B12000-memory.dmp

Filesize
136KB

Download
memory/3912-28-0x000000007FB90000-0x000000007FBA0000-memory.dmp

Filesize
64KB

Download
memory/3912-49-0x0000000007300000-0x000000000731A000-memory.dmp

Filesize
104KB

Download
memory/3912-48-0x0000000007210000-0x0000000007224000-memory.dmp

Filesize
80KB

Download
memory/3912-47-0x0000000007200000-0x000000000720E000-memory.dmp

Filesize
56KB

Download
memory/3912-46-0x00000000071C0000-0x00000000071D1000-memory.dmp

Filesize
68KB

Download
memory/3912-45-0x0000000007260000-0x00000000072F6000-memory.dmp

Filesize
600KB

Download
memory/3912-44-0x00000000071A0000-0x00000000071AA000-memory.dmp

Filesize
40KB

Download
memory/3912-42-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/3912-43-0x00000000070B0000-0x0000000007153000-memory.dmp

Filesize
652KB

Download
memory/3912-41-0x0000000007090000-0x00000000070AE000-memory.dmp

Filesize
120KB

Download
memory/3912-31-0x0000000070F20000-0x0000000071274000-memory.dmp

Filesize
3.3MB

Download
memory/3912-30-0x00000000707C0000-0x000000007080C000-memory.dmp

Filesize
304KB

Download
memory/4652-158-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4652-56-0x0000000003B30000-0x0000000003F29000-memory.dmp

Filesize
4.0MB

Download
memory/4652-59-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4652-108-0x0000000003B30000-0x0000000003F29000-memory.dmp

Filesize
4.0MB

Download
memory/4972-265-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download