glupteba | e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Size

4.2MB
MD5

3ce7c9e525dde1ad1ea7674817812fd0
SHA1

d0aa52508bfbe1a464fc3a2309a78fa61f8cd1d4
SHA256

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173
SHA512

f62b5efe6d122947390c7da322dd26f060d8cf6ffe65bdc95f742dc601a9dca59eb3981280af59eb2e02e9efd8e9d74d06be02d1141e08dc7a302e1ae9e20bd2
SSDEEP

98304:SExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRe:SMby0Sruak17xwL

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4724-2-0x0000000004050000-0x000000000493B000-memory.dmp	family_glupteba
behavioral1/memory/4724-3-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/748-58-0x0000000003FD0000-0x00000000048BB000-memory.dmp	family_glupteba
behavioral1/memory/748-59-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4724-74-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/748-154-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-255-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-265-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-267-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-270-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-273-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-277-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-280-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-283-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-285-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-288-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-291-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-295-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/4924-298-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2440 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4924 csrss.exe
4108 injector.exe
4272 windefender.exe
3080 windefender.exe

pid	process
2440	netsh.exe

pid	process
4924	csrss.exe
4108	injector.exe
4272	windefender.exe
3080	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/4272-264-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3080-268-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3080-274-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exee41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

Drops file in Windows directory 4 IoCs

Processes:

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4004 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2652 schtasks.exe
3184 schtasks.exe

pid	process
4004	sc.exe

pid	process
2652	schtasks.exe
3184	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exee41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exepowershell.exee41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
3732	powershell.exe
3732	powershell.exe
4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
3392	powershell.exe
3392	powershell.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4924	csrss.exe
4924	csrss.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4924	csrss.exe
4924	csrss.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4924	csrss.exe
4924	csrss.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe
4108	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exee41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Token: SeImpersonatePrivilege	4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	csrss.exe
Token: SeSecurityPrivilege	4004	sc.exe
Token: SeSecurityPrivilege	4004	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exee41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 4724 wrote to memory of 3732	4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 4724 wrote to memory of 3732	4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 4724 wrote to memory of 3732	4724	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 3392	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 3392	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 3392	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 4408	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	cmd.exe
PID 748 wrote to memory of 4408	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	cmd.exe
PID 4408 wrote to memory of 2440	4408	cmd.exe	netsh.exe
PID 4408 wrote to memory of 2440	4408	cmd.exe	netsh.exe
PID 748 wrote to memory of 1484	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 1484	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 1484	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 4416	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 4416	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 4416	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	powershell.exe
PID 748 wrote to memory of 4924	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	csrss.exe
PID 748 wrote to memory of 4924	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	csrss.exe
PID 748 wrote to memory of 4924	748	e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe	csrss.exe
PID 4924 wrote to memory of 4460	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4460	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4460	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4048	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4048	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4048	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4880	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4880	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4880	4924	csrss.exe	powershell.exe
PID 4924 wrote to memory of 4108	4924	csrss.exe	injector.exe
PID 4924 wrote to memory of 4108	4924	csrss.exe	injector.exe
PID 4272 wrote to memory of 372	4272	windefender.exe	cmd.exe
PID 4272 wrote to memory of 372	4272	windefender.exe	cmd.exe
PID 4272 wrote to memory of 372	4272	windefender.exe	cmd.exe
PID 372 wrote to memory of 4004	372	cmd.exe	sc.exe
PID 372 wrote to memory of 4004	372	cmd.exe	sc.exe
PID 372 wrote to memory of 4004	372	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
"C:\Users\Admin\AppData\Local\Temp\e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Users\Admin\AppData\Local\Temp\e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe
"C:\Users\Admin\AppData\Local\Temp\e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2652

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3184

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_osiyhkau.jko.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
b4646e9d198b485ca36e3c88830670e8

SHA1
9d1be19cd5caceb0148844086c74217f1879fa32

SHA256
d8c4624043c3705b0eb783f36eec94e8c30af4deb418630d9e6a832042e47259

SHA512
e20d58124a64d2ad1672598047d69cb73a25e4508d1698d16130af8e10b12872b276a788005b9b89c824d6b0d46fc9cc14d1fc3429761c56967ac61544ca24f9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
73595ba70c6f4e0f024b46533c8fca5a

SHA1
04218abd65aea068fbe0c177cff2cf869395cbce

SHA256
76e8100e4af1ed13009d35e6282289325e019c7acd31a2f2f96ef46a1c5f1882

SHA512
23e3ed1b021e91230b87887abd0a04ddcae8d1a50c09b292b93b190303bc9fc17ba4097fdf76c4ddee9cadf6874eaa9715738f76caa9a50a265f8cd7647d90fd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
b77cd3dc40a939975afe967154cfeaae

SHA1
633d897ce1f2d6bae5a45646008e9b5db8848183

SHA256
116cbf31ca460fb087a99af14ccd1d2d6a10b2e33ef79bd9703261498b122b6f

SHA512
e74ea846b4f6e2aa45db9add70482e22336f88ecff3c26b78920cb4f73c572450847a4488434f8030ea65463b0c6bcee1180832f4b573a5b45e4ad152917ba55

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
d41eef86d21d6ef2941bc53ba51f89cf

SHA1
e1a29acae8c0d6ffefd1cf56ff97eab7b1882707

SHA256
88b83f81ad63bcd625ce0b8efdfb52ce41d8bac0c87c057f06918659ad2e6ba2

SHA512
7c3b929f5e4534127be96b02a1370e08d88d6e335c3308b06d12ec48d13b7755635d8ff8ba43e83551bd4d7110ef8dd59c32acbadaead576fc733a0ee4fd2b16

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3d9eac663cdfa4e65acf90e487b3b6a0

SHA1
8a97eb3e1b2840e4a78593f8a92aa43691bb6c5d

SHA256
308a163ec57002b9106f664750b4442e2fbe42d8d0097c96c611e60702ad8b7f

SHA512
080401e62c24013e6a24ecd14b474561d9c2e022e9f5ec1957d05b644d169118d9072a5743075dc054e9990a9b2ce1ad6dfb5819c9f0dd85646a932ecc584903

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
3ce7c9e525dde1ad1ea7674817812fd0

SHA1
d0aa52508bfbe1a464fc3a2309a78fa61f8cd1d4

SHA256
e41e0a6eea816c1871c7b50ccdcf4e94ece6795d5e9dfd2d58294a84f2131173

SHA512
f62b5efe6d122947390c7da322dd26f060d8cf6ffe65bdc95f742dc601a9dca59eb3981280af59eb2e02e9efd8e9d74d06be02d1141e08dc7a302e1ae9e20bd2

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/748-154-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/748-59-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/748-56-0x0000000003BC0000-0x0000000003FC6000-memory.dmp

Filesize
4.0MB

Download
memory/748-58-0x0000000003FD0000-0x00000000048BB000-memory.dmp

Filesize
8.9MB

Download
memory/748-119-0x0000000003BC0000-0x0000000003FC6000-memory.dmp

Filesize
4.0MB

Download
memory/1484-95-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1484-108-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/1484-109-0x0000000070760000-0x0000000070AB4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-120-0x0000000003130000-0x0000000003140000-memory.dmp

Filesize
64KB

Download
memory/1484-96-0x0000000003130000-0x0000000003140000-memory.dmp

Filesize
64KB

Download
memory/1484-97-0x0000000003130000-0x0000000003140000-memory.dmp

Filesize
64KB

Download
memory/1484-122-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3080-274-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3080-268-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3392-87-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3392-75-0x000000007F010000-0x000000007F020000-memory.dmp

Filesize
64KB

Download
memory/3392-88-0x00000000076D0000-0x00000000076E1000-memory.dmp

Filesize
68KB

Download
memory/3392-86-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3392-85-0x00000000073B0000-0x0000000007453000-memory.dmp

Filesize
652KB

Download
memory/3392-73-0x0000000070760000-0x0000000070AB4000-memory.dmp

Filesize
3.3MB

Download
memory/3392-72-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/3392-62-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3392-61-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3392-60-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3392-89-0x0000000007720000-0x0000000007734000-memory.dmp

Filesize
80KB

Download
memory/3392-92-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3732-31-0x0000000070760000-0x0000000070AB4000-memory.dmp

Filesize
3.3MB

Download
memory/3732-6-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3732-54-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3732-51-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

Filesize
32KB

Download
memory/3732-50-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Filesize
104KB

Download
memory/3732-49-0x0000000007A70000-0x0000000007A84000-memory.dmp

Filesize
80KB

Download
memory/3732-48-0x0000000007A50000-0x0000000007A5E000-memory.dmp

Filesize
56KB

Download
memory/3732-4-0x0000000002D50000-0x0000000002D86000-memory.dmp

Filesize
216KB

Download
memory/3732-47-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/3732-46-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Filesize
600KB

Download
memory/3732-45-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3732-44-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/3732-43-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3732-42-0x0000000007910000-0x00000000079B3000-memory.dmp

Filesize
652KB

Download
memory/3732-41-0x00000000078F0000-0x000000000790E000-memory.dmp

Filesize
120KB

Download
memory/3732-10-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/3732-30-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/3732-28-0x00000000078B0000-0x00000000078E2000-memory.dmp

Filesize
200KB

Download
memory/3732-29-0x000000007EE80000-0x000000007EE90000-memory.dmp

Filesize
64KB

Download
memory/3732-27-0x00000000076F0000-0x000000000770A000-memory.dmp

Filesize
104KB

Download
memory/3732-26-0x0000000007D50000-0x00000000083CA000-memory.dmp

Filesize
6.5MB

Download
memory/3732-25-0x0000000007650000-0x00000000076C6000-memory.dmp

Filesize
472KB

Download
memory/3732-24-0x0000000006890000-0x00000000068D4000-memory.dmp

Filesize
272KB

Download
memory/3732-23-0x0000000006370000-0x00000000063BC000-memory.dmp

Filesize
304KB

Download
memory/3732-22-0x0000000006350000-0x000000000636E000-memory.dmp

Filesize
120KB

Download
memory/3732-21-0x0000000005E60000-0x00000000061B4000-memory.dmp

Filesize
3.3MB

Download
memory/3732-7-0x0000000005450000-0x0000000005A78000-memory.dmp

Filesize
6.2MB

Download
memory/3732-5-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3732-11-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/3732-8-0x0000000002E00000-0x0000000002E10000-memory.dmp

Filesize
64KB

Download
memory/3732-9-0x0000000005AB0000-0x0000000005AD2000-memory.dmp

Filesize
136KB

Download
memory/4272-264-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4416-136-0x0000000070760000-0x0000000070AB4000-memory.dmp

Filesize
3.3MB

Download
memory/4416-137-0x000000007F770000-0x000000007F780000-memory.dmp

Filesize
64KB

Download
memory/4416-135-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/4416-124-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4416-123-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4724-1-0x0000000003C50000-0x000000000404D000-memory.dmp

Filesize
4.0MB

Download
memory/4724-2-0x0000000004050000-0x000000000493B000-memory.dmp

Filesize
8.9MB

Download
memory/4724-74-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4724-57-0x0000000003C50000-0x000000000404D000-memory.dmp

Filesize
4.0MB

Download
memory/4724-3-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-267-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-265-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-270-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-273-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-255-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-277-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-280-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-283-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-285-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-288-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-291-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-295-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/4924-298-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download