glupteba | bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Size

4.2MB
MD5

244c57389df60192dcec01a13fd1b3d3
SHA1

95b4e80ba74bed5e37dc99921fc0c3eb849a27ce
SHA256

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d
SHA512

c761fada2075c396b4c898227251e13b02cd30f196f1a5f4dc6af2a880ef2497a4bc11c3aefe856ca880f2e6115795098c6738981d2aa960c4f1f0e79de40ef8
SSDEEP

98304:dLQYZG/dgZ86BiJBiuHE0xNIsAKMiZ9poPnhJgyiGI:9f8gKxTxapLMoPnzgf

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1344-2-0x0000000004030000-0x000000000491B000-memory.dmp	family_glupteba
behavioral1/memory/1344-3-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4080-56-0x0000000004000000-0x00000000048EB000-memory.dmp	family_glupteba
behavioral1/memory/1344-57-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4080-58-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4080-156-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-258-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-267-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-269-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-271-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-273-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-275-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-276-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-279-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-281-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-283-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-285-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-287-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/884-289-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3140 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

884 csrss.exe
3696 injector.exe
2748 windefender.exe
4656 windefender.exe

pid	process
3140	netsh.exe

pid	process
884	csrss.exe
3696	injector.exe
2748	windefender.exe
4656	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/2748-265-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4656-268-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4656-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe

Drops file in Windows directory 4 IoCs

Processes:

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
File created	C:\Windows\rss\csrss.exe	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4552 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4024 1344 WerFault.exe bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1548 schtasks.exe
2672 schtasks.exe

pid	process
4552	sc.exe

pid	pid_target	process	target process
4024	1344	WerFault.exe	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe

pid	process
1548	schtasks.exe
2672	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

windefender.exebd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exebd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exepowershell.exebd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
2860	powershell.exe
2860	powershell.exe
1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
3056	powershell.exe
3056	powershell.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
2688	powershell.exe
2688	powershell.exe
2508	powershell.exe
2508	powershell.exe
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
884	csrss.exe
884	csrss.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
884	csrss.exe
884	csrss.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
884	csrss.exe
884	csrss.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe
3696	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exebd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Token: SeImpersonatePrivilege	1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeSystemEnvironmentPrivilege	884	csrss.exe
Token: SeSecurityPrivilege	4552	sc.exe
Token: SeSecurityPrivilege	4552	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exebd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 1344 wrote to memory of 2860	1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 1344 wrote to memory of 2860	1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 1344 wrote to memory of 2860	1344	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 3056	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 3056	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 3056	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2672	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	cmd.exe
PID 4080 wrote to memory of 2672	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	cmd.exe
PID 2672 wrote to memory of 3140	2672	cmd.exe	netsh.exe
PID 2672 wrote to memory of 3140	2672	cmd.exe	netsh.exe
PID 4080 wrote to memory of 2176	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2176	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2176	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2688	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2688	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 2688	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	powershell.exe
PID 4080 wrote to memory of 884	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	csrss.exe
PID 4080 wrote to memory of 884	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	csrss.exe
PID 4080 wrote to memory of 884	4080	bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe	csrss.exe
PID 884 wrote to memory of 2508	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 2508	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 2508	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 2668	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 2668	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 2668	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 1640	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 1640	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 1640	884	csrss.exe	powershell.exe
PID 884 wrote to memory of 3696	884	csrss.exe	injector.exe
PID 884 wrote to memory of 3696	884	csrss.exe	injector.exe
PID 2748 wrote to memory of 2464	2748	windefender.exe	cmd.exe
PID 2748 wrote to memory of 2464	2748	windefender.exe	cmd.exe
PID 2748 wrote to memory of 2464	2748	windefender.exe	cmd.exe
PID 2464 wrote to memory of 4552	2464	cmd.exe	sc.exe
PID 2464 wrote to memory of 4552	2464	cmd.exe	sc.exe
PID 2464 wrote to memory of 4552	2464	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
"C:\Users\Admin\AppData\Local\Temp\bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Users\Admin\AppData\Local\Temp\bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe
"C:\Users\Admin\AppData\Local\Temp\bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3140

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1548

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:2916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3696

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2672

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 764
2⤵
- Program crash
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1344 -ip 1344
1⤵
PID:2140

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1nahk3mj.jcg.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
81f384b5e5bed23382403031e2ff2db0

SHA1
8b4a52683144be3b80c817365a9433f3e2acd374

SHA256
1d224a82425c57e6f4e28cee66f336913693d8a04dd532c46d6bc896f8c1ca20

SHA512
9e24f8ca21682b2220c62a29366fe5b0994cabbb7b39dc5c03a5c5119fb3fbcabfbed88aae0b9609b93ad69c8864771b1246e7f14737c79c0eaec4ce9a47abd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3b6b1983c3b41f36e7700fb28d502c7b

SHA1
98135d14220080f0aa1b8e564d68f19bc28763bf

SHA256
b15367bd6078d2b39d0796e1cddd604181151a146a5437354792226d0fa4ff2d

SHA512
7d7287230bdf9ef9d993b75ae7b39d05e19fec2e5ec1f8b9bd8112c4c993a7348a9dee0155c28f2570f023e932321cf115fa5b94e507880d27b93e2a469ad5d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5a72ea55e9176d73806e713a47ca7c51

SHA1
dcc9eaeacce6ce1b169b0ae4fa23e54b9c1a7acf

SHA256
cdfcb42836283b9abb0c2fd6d7835548ba67e1deacab69ff1a951e0f8243f398

SHA512
7285d21168f34a2927aaff97cfe324c701ef249b0270db0e3f520324df8f0e2f405f642bf988dcac2e8945f74f5fd8066f0a964d9642b882c7c189f2334083c8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5e6ff5482e60693eeaa461a15e29ad06

SHA1
717470cf0c7d14b3b882b4cfde5d8c1ec55afeb8

SHA256
04070c6c36aa5b51b6e7c59fc9b64939162088217030793aac5163b63ec09cf7

SHA512
c1a369887fcb5a51e92044d1b6a2899aabf9abc3a306b670f6e384f08aa6da9b9b86effdc4bf71ec04c68075b01f6d018a74710d1b980080907763695aef886b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
999c8ef6a8530161f86dcdc8cc1b32b9

SHA1
53cddb7d444408a36ce78d439da47fdd0008e346

SHA256
852732ba39be4dd1dbc16c3b88ee1e5ff2438f0051523079082ed28286b0a0de

SHA512
1d3dc3f826ff0580b52e047460fb648f406eb1c5cf6fcc442fa58487bb0d6658b96569194d95943af28ce07d0b9f4393c57e7ca6df3a0ff22f2e152ef96adc39

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
244c57389df60192dcec01a13fd1b3d3

SHA1
95b4e80ba74bed5e37dc99921fc0c3eb849a27ce

SHA256
bd9f77442d101186eb671e22f8870adb61df1b5ded0e0a9130282a8c0df9930d

SHA512
c761fada2075c396b4c898227251e13b02cd30f196f1a5f4dc6af2a880ef2497a4bc11c3aefe856ca880f2e6115795098c6738981d2aa960c4f1f0e79de40ef8

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/884-258-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-283-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-273-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-271-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-269-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-267-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-276-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-281-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-279-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-275-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-285-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-287-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/884-289-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1344-1-0x0000000003C20000-0x0000000004021000-memory.dmp

Filesize
4.0MB

Download
memory/1344-2-0x0000000004030000-0x000000000491B000-memory.dmp

Filesize
8.9MB

Download
memory/1344-57-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1344-3-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/1344-54-0x0000000003C20000-0x0000000004021000-memory.dmp

Filesize
4.0MB

Download
memory/2176-118-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/2176-107-0x0000000070BB0000-0x0000000070BFC000-memory.dmp

Filesize
304KB

Download
memory/2176-93-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2176-121-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2176-94-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/2176-104-0x00000000062F0000-0x0000000006644000-memory.dmp

Filesize
3.3MB

Download
memory/2176-119-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/2176-106-0x000000007F130000-0x000000007F140000-memory.dmp

Filesize
64KB

Download
memory/2176-108-0x0000000070D30000-0x0000000071084000-memory.dmp

Filesize
3.3MB

Download
memory/2688-137-0x000000007F420000-0x000000007F430000-memory.dmp

Filesize
64KB

Download
memory/2688-124-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/2688-135-0x0000000005800000-0x0000000005B54000-memory.dmp

Filesize
3.3MB

Download
memory/2688-123-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/2688-122-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2748-265-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2860-42-0x0000000007D40000-0x0000000007DE3000-memory.dmp

Filesize
652KB

Download
memory/2860-23-0x0000000006CA0000-0x0000000006CE4000-memory.dmp

Filesize
272KB

Download
memory/2860-5-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2860-4-0x0000000003170000-0x00000000031A6000-memory.dmp

Filesize
216KB

Download
memory/2860-6-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/2860-7-0x0000000005A90000-0x00000000060B8000-memory.dmp

Filesize
6.2MB

Download
memory/2860-8-0x0000000005780000-0x00000000057A2000-memory.dmp

Filesize
136KB

Download
memory/2860-9-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/2860-10-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/2860-20-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/2860-21-0x0000000006780000-0x000000000679E000-memory.dmp

Filesize
120KB

Download
memory/2860-22-0x00000000067B0000-0x00000000067FC000-memory.dmp

Filesize
304KB

Download
memory/2860-24-0x0000000007A90000-0x0000000007B06000-memory.dmp

Filesize
472KB

Download
memory/2860-25-0x0000000008190000-0x000000000880A000-memory.dmp

Filesize
6.5MB

Download
memory/2860-26-0x0000000007B30000-0x0000000007B4A000-memory.dmp

Filesize
104KB

Download
memory/2860-27-0x000000007EFE0000-0x000000007EFF0000-memory.dmp

Filesize
64KB

Download
memory/2860-28-0x0000000007CE0000-0x0000000007D12000-memory.dmp

Filesize
200KB

Download
memory/2860-52-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2860-49-0x0000000007EE0000-0x0000000007EE8000-memory.dmp

Filesize
32KB

Download
memory/2860-48-0x0000000007EF0000-0x0000000007F0A000-memory.dmp

Filesize
104KB

Download
memory/2860-47-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

Filesize
80KB

Download
memory/2860-46-0x0000000007E80000-0x0000000007E8E000-memory.dmp

Filesize
56KB

Download
memory/2860-29-0x0000000070AB0000-0x0000000070AFC000-memory.dmp

Filesize
304KB

Download
memory/2860-45-0x0000000007E40000-0x0000000007E51000-memory.dmp

Filesize
68KB

Download
memory/2860-44-0x0000000007F40000-0x0000000007FD6000-memory.dmp

Filesize
600KB

Download
memory/2860-43-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Filesize
40KB

Download
memory/2860-40-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/2860-30-0x0000000070C30000-0x0000000070F84000-memory.dmp

Filesize
3.3MB

Download
memory/2860-41-0x0000000007D20000-0x0000000007D3E000-memory.dmp

Filesize
120KB

Download
memory/3056-88-0x0000000007B20000-0x0000000007B34000-memory.dmp

Filesize
80KB

Download
memory/3056-85-0x00000000077B0000-0x0000000007853000-memory.dmp

Filesize
652KB

Download
memory/3056-74-0x0000000070BB0000-0x0000000070BFC000-memory.dmp

Filesize
304KB

Download
memory/3056-86-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3056-61-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3056-59-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/3056-60-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/3056-87-0x0000000007AD0000-0x0000000007AE1000-memory.dmp

Filesize
68KB

Download
memory/3056-75-0x0000000071350000-0x00000000716A4000-memory.dmp

Filesize
3.3MB

Download
memory/3056-91-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/3056-73-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/3056-62-0x0000000005F80000-0x00000000062D4000-memory.dmp

Filesize
3.3MB

Download
memory/3056-72-0x0000000006610000-0x000000000665C000-memory.dmp

Filesize
304KB

Download
memory/4080-125-0x0000000003C00000-0x0000000003FFB000-memory.dmp

Filesize
4.0MB

Download
memory/4080-156-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4080-58-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4080-56-0x0000000004000000-0x00000000048EB000-memory.dmp

Filesize
8.9MB

Download
memory/4080-55-0x0000000003C00000-0x0000000003FFB000-memory.dmp

Filesize
4.0MB

Download
memory/4656-268-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4656-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download