glupteba | 2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Size

4.2MB
MD5

588fc813f8c4b9494058548e1a45343a
SHA1

594c00a62008c5e97f7f0aab7f78550383338742
SHA256

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877
SHA512

30227b5c5b35066e02a85adcf55f0c9b1fe804b1642cecb1735b99b3dc0d827d7ec13f2779f025ca440a818e8e337da99ae8b99c43ac8243520691102fd920d6
SSDEEP

98304:iS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORb:TEcJzF4UNHqA/dsmoVS4YAf19c

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4612-2-0x0000000004100000-0x00000000049EB000-memory.dmp	family_glupteba
behavioral1/memory/4612-3-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3828-56-0x0000000003EE0000-0x00000000047CB000-memory.dmp	family_glupteba
behavioral1/memory/3828-57-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4612-66-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3828-146-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/3828-154-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-257-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-267-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-269-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-272-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-275-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-278-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-281-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-285-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-287-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-290-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-293-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-296-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba
behavioral1/memory/4888-299-0x0000000000400000-0x0000000001E06000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1928 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4888 csrss.exe
1972 injector.exe
3684 windefender.exe
4668 windefender.exe

pid	process
1928	netsh.exe

pid	process
4888	csrss.exe
1972	injector.exe
3684	windefender.exe
4668	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/3684-266-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4668-270-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4668-276-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe

Drops file in Windows directory 4 IoCs

Processes:

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
File created	C:\Windows\rss\csrss.exe	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1352 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1820 schtasks.exe
4348 schtasks.exe

pid	process
1352	sc.exe

pid	process
1820	schtasks.exe
4348	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

windefender.exepowershell.exepowershell.exepowershell.exepowershell.exe2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exepowershell.exe2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4656	powershell.exe
4656	powershell.exe
4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
4492	powershell.exe
4492	powershell.exe
4492	powershell.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
4888	csrss.exe
4888	csrss.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
4888	csrss.exe
4888	csrss.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
4888	csrss.exe
4888	csrss.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe
1972	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Token: SeImpersonatePrivilege	4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeSystemEnvironmentPrivilege	4888	csrss.exe
Token: SeSecurityPrivilege	1352	sc.exe
Token: SeSecurityPrivilege	1352	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 4612 wrote to memory of 4656	4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 4612 wrote to memory of 4656	4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 4612 wrote to memory of 4656	4612	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4492	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4492	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4492	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4524	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	cmd.exe
PID 3828 wrote to memory of 4524	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	cmd.exe
PID 4524 wrote to memory of 1928	4524	cmd.exe	netsh.exe
PID 4524 wrote to memory of 1928	4524	cmd.exe	netsh.exe
PID 3828 wrote to memory of 4284	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4284	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4284	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4432	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4432	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4432	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	powershell.exe
PID 3828 wrote to memory of 4888	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	csrss.exe
PID 3828 wrote to memory of 4888	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	csrss.exe
PID 3828 wrote to memory of 4888	3828	2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe	csrss.exe
PID 4888 wrote to memory of 2668	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 2668	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 2668	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 116	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 116	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 116	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 448	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 448	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 448	4888	csrss.exe	powershell.exe
PID 4888 wrote to memory of 1972	4888	csrss.exe	injector.exe
PID 4888 wrote to memory of 1972	4888	csrss.exe	injector.exe
PID 3684 wrote to memory of 3708	3684	windefender.exe	cmd.exe
PID 3684 wrote to memory of 3708	3684	windefender.exe	cmd.exe
PID 3684 wrote to memory of 3708	3684	windefender.exe	cmd.exe
PID 3708 wrote to memory of 1352	3708	cmd.exe	sc.exe
PID 3708 wrote to memory of 1352	3708	cmd.exe	sc.exe
PID 3708 wrote to memory of 1352	3708	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
"C:\Users\Admin\AppData\Local\Temp\2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Admin\AppData\Local\Temp\2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe
"C:\Users\Admin\AppData\Local\Temp\2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:1928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4348

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1972

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1820

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ri3radd.jmm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
46df70f5c5f23888541bd264b9bd717c

SHA1
c2b232b6b14fec585a2e8029c34ee72ff4676471

SHA256
9812bfea2620f32eb699fc4649154b3e9e906017b3744ce7191b5432d32e85db

SHA512
62fd54b4d5b0a967dbff3e74a873db531f5d5c2bea35f566a6019543b3cecc9cc23f43ed909e3a140ae8931f434465817f565fe75f5ae58f21f1c1d7f46eda57

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e1104d5dd220df538a3afed0cb7d4197

SHA1
aa069a1af6e1440c9bc5a0b1dd5f552749ae5cf7

SHA256
718021e23a9e9d33d4e4da392bd39a38d7ec6e7e593ec55a3c0efd2c174ebfab

SHA512
7dcb10716a13600dd44894263fb290eed92e105916fa891999ca85f22f8b25f425768a00908a8c668cb9821592989b705be30e9c3ddf5b0a1113428fd91d1afd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
cdb11a389ef5299db1c8e4dc08738e39

SHA1
715d45e155d006b335f5530bd2abb0eeb86b430f

SHA256
c41db5cb8133b6b4abe606dc1a442b89049264c88ee8dae588a8feefc153c01f

SHA512
7d8cba4bc63375ece9e3af496138eefaecb9633b920228e99a94c731c0fe2b0d4ca21d4ed1e903be1bcf2f44225e3579bd1beb72eb68846773a983cfe3b08c0f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
73fd44e5f13f75dd54d7611751038fa5

SHA1
fe670b142706b95d582bb7dbc1af5163737ca775

SHA256
4e0d76bb3ce97f1bee4f29ee3c68117f7543a16b0ba609eaf78e3606545a1297

SHA512
052ab4818ed15934c5d862a1a3f857d3bc8cef8f281eec1e27f83cc7b6bd606b0145735a51720309bf1827f4e790518a626f42ad227dce0b502fd9c8c1bb1049

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
a4aab4dc344e49a936cc9893486ef966

SHA1
f6edc9ec86685dc9f94801e5ff21ed3b16abec2d

SHA256
778dacb7422548965b52ae06ad83cb2f4435d6fa6fd3e251018ae59406b3d1e9

SHA512
309b639b7c94b11fc4d71a433ceb6e944ce77e6fe996de069fbdc7c300649e34e4211b8088cef940bd99fc19b40bf5aeb13c6918a26960baf08490dff9dc75be

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
588fc813f8c4b9494058548e1a45343a

SHA1
594c00a62008c5e97f7f0aab7f78550383338742

SHA256
2e421939ab028995e2e086491abf3750a91aeb56f3aa076ada30bb6968d10877

SHA512
30227b5c5b35066e02a85adcf55f0c9b1fe804b1642cecb1735b99b3dc0d827d7ec13f2779f025ca440a818e8e337da99ae8b99c43ac8243520691102fd920d6

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/3684-266-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3828-106-0x0000000003AE0000-0x0000000003ED9000-memory.dmp

Filesize
4.0MB

Download
memory/3828-54-0x0000000003AE0000-0x0000000003ED9000-memory.dmp

Filesize
4.0MB

Download
memory/3828-56-0x0000000003EE0000-0x00000000047CB000-memory.dmp

Filesize
8.9MB

Download
memory/3828-57-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3828-154-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/3828-146-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4284-119-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4284-92-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4284-118-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4284-105-0x000000006FDE0000-0x000000006FE2C000-memory.dmp

Filesize
304KB

Download
memory/4284-121-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4284-108-0x000000006FF60000-0x00000000702B4000-memory.dmp

Filesize
3.3MB

Download
memory/4284-107-0x000000007F7D0000-0x000000007F7E0000-memory.dmp

Filesize
64KB

Download
memory/4284-93-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4284-94-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4432-122-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4432-136-0x0000000070560000-0x00000000708B4000-memory.dmp

Filesize
3.3MB

Download
memory/4432-123-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4432-124-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4432-135-0x000000006FDE0000-0x000000006FE2C000-memory.dmp

Filesize
304KB

Download
memory/4492-83-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/4492-71-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/4492-85-0x00000000072D0000-0x00000000072E1000-memory.dmp

Filesize
68KB

Download
memory/4492-84-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/4492-73-0x0000000070560000-0x00000000708B4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-89-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4492-58-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4492-59-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/4492-65-0x0000000005790000-0x0000000005AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-72-0x000000006FDE0000-0x000000006FE2C000-memory.dmp

Filesize
304KB

Download
memory/4492-86-0x0000000007320000-0x0000000007334000-memory.dmp

Filesize
80KB

Download
memory/4612-66-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4612-3-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4612-1-0x0000000003CF0000-0x00000000040F4000-memory.dmp

Filesize
4.0MB

Download
memory/4612-55-0x0000000003CF0000-0x00000000040F4000-memory.dmp

Filesize
4.0MB

Download
memory/4612-2-0x0000000004100000-0x00000000049EB000-memory.dmp

Filesize
8.9MB

Download
memory/4656-26-0x0000000007740000-0x000000000775A000-memory.dmp

Filesize
104KB

Download
memory/4656-9-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/4656-46-0x0000000007A90000-0x0000000007A9E000-memory.dmp

Filesize
56KB

Download
memory/4656-45-0x0000000007A50000-0x0000000007A61000-memory.dmp

Filesize
68KB

Download
memory/4656-44-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Filesize
600KB

Download
memory/4656-43-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/4656-42-0x0000000007A40000-0x0000000007A4A000-memory.dmp

Filesize
40KB

Download
memory/4656-41-0x0000000007950000-0x00000000079F3000-memory.dmp

Filesize
652KB

Download
memory/4656-40-0x0000000007930000-0x000000000794E000-memory.dmp

Filesize
120KB

Download
memory/4656-30-0x000000006FF60000-0x00000000702B4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-29-0x000000006FDE0000-0x000000006FE2C000-memory.dmp

Filesize
304KB

Download
memory/4656-27-0x00000000078F0000-0x0000000007922000-memory.dmp

Filesize
200KB

Download
memory/4656-28-0x000000007FC10000-0x000000007FC20000-memory.dmp

Filesize
64KB

Download
memory/4656-52-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4656-25-0x0000000007DA0000-0x000000000841A000-memory.dmp

Filesize
6.5MB

Download
memory/4656-24-0x00000000076A0000-0x0000000007716000-memory.dmp

Filesize
472KB

Download
memory/4656-23-0x00000000068C0000-0x0000000006904000-memory.dmp

Filesize
272KB

Download
memory/4656-22-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/4656-21-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/4656-20-0x0000000005F10000-0x0000000006264000-memory.dmp

Filesize
3.3MB

Download
memory/4656-15-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/4656-47-0x0000000007AB0000-0x0000000007AC4000-memory.dmp

Filesize
80KB

Download
memory/4656-8-0x00000000053B0000-0x00000000053D2000-memory.dmp

Filesize
136KB

Download
memory/4656-7-0x00000000057E0000-0x0000000005E08000-memory.dmp

Filesize
6.2MB

Download
memory/4656-6-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/4656-5-0x0000000073F40000-0x00000000746F0000-memory.dmp

Filesize
7.7MB

Download
memory/4656-4-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Filesize
216KB

Download
memory/4656-49-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Filesize
32KB

Download
memory/4656-48-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

Filesize
104KB

Download
memory/4668-276-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4668-270-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4888-281-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-269-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-272-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-275-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-267-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-278-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-257-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-285-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-287-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-290-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-293-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-296-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download
memory/4888-299-0x0000000000400000-0x0000000001E06000-memory.dmp

Filesize
26.0MB

Download