glupteba | c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Size

4.2MB
MD5

87916ba7d7b5f95c1007925488ffac52
SHA1

c2abc932a51e7e34b456e2fdb1568d749fbafc8e
SHA256

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37
SHA512

8cdd68f5399ff8cf9cb194f0e5b1bfa3ce0dababa7195eaa83b9e74be90b53b474a73ae9f14299b7b2428a066f0fb769a4f6cc7261240ac966186f3c611ffb34
SSDEEP

98304:jVFRqPMdPA984H0WMAw6acMgLNchhd+W2lPIIo31xn1vrLR/3Lzr:ZFYkS+E0uawLNQ+/9Bo7/7

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-2-0x0000000004140000-0x0000000004A2B000-memory.dmp	family_glupteba
behavioral1/memory/2196-3-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/2196-54-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/3044-57-0x0000000003E60000-0x000000000474B000-memory.dmp	family_glupteba
behavioral1/memory/3044-58-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/3044-154-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-259-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-260-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-269-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-271-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-273-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-275-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-277-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-279-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-281-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-283-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-285-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-287-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral1/memory/4296-289-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

812 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4296 csrss.exe
1068 injector.exe
2780 windefender.exe
3000 windefender.exe

pid	process
812	netsh.exe

pid	process
4296	csrss.exe
1068	injector.exe
2780	windefender.exe
3000	windefender.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/2780-268-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3000-270-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3000-274-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3000-280-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exec0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe

description	ioc	process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
File created	C:\Windows\rss\csrss.exe	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2120 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4992 schtasks.exe
744 schtasks.exe

pid	process
2120	sc.exe

pid	process
4992	schtasks.exe
744	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exec0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exepowershell.exec0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
2796	powershell.exe
2796	powershell.exe
2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3600	powershell.exe
3600	powershell.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
3716	powershell.exe
3716	powershell.exe
4952	powershell.exe
4952	powershell.exe
3576	powershell.exe
3576	powershell.exe
1668	powershell.exe
1668	powershell.exe
4400	powershell.exe
4400	powershell.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
4296	csrss.exe
4296	csrss.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
4296	csrss.exe
4296	csrss.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
4296	csrss.exe
4296	csrss.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe
1068	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exec0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Token: SeImpersonatePrivilege	2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	csrss.exe
Token: SeSecurityPrivilege	2120	sc.exe
Token: SeSecurityPrivilege	2120	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exec0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 2196 wrote to memory of 2796	2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 2196 wrote to memory of 2796	2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 2196 wrote to memory of 2796	2196	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3600	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3600	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3600	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3800	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	cmd.exe
PID 3044 wrote to memory of 3800	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	cmd.exe
PID 3800 wrote to memory of 812	3800	cmd.exe	netsh.exe
PID 3800 wrote to memory of 812	3800	cmd.exe	netsh.exe
PID 3044 wrote to memory of 3716	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3716	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 3716	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 4952	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 4952	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 4952	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	powershell.exe
PID 3044 wrote to memory of 4296	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	csrss.exe
PID 3044 wrote to memory of 4296	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	csrss.exe
PID 3044 wrote to memory of 4296	3044	c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe	csrss.exe
PID 4296 wrote to memory of 3576	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 3576	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 3576	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 1668	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 1668	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 1668	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 4400	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 4400	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 4400	4296	csrss.exe	powershell.exe
PID 4296 wrote to memory of 1068	4296	csrss.exe	injector.exe
PID 4296 wrote to memory of 1068	4296	csrss.exe	injector.exe
PID 2780 wrote to memory of 4644	2780	windefender.exe	cmd.exe
PID 2780 wrote to memory of 4644	2780	windefender.exe	cmd.exe
PID 2780 wrote to memory of 4644	2780	windefender.exe	cmd.exe
PID 4644 wrote to memory of 2120	4644	cmd.exe	sc.exe
PID 4644 wrote to memory of 2120	4644	cmd.exe	sc.exe
PID 4644 wrote to memory of 2120	4644	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
"C:\Users\Admin\AppData\Local\Temp\c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Users\Admin\AppData\Local\Temp\c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe
"C:\Users\Admin\AppData\Local\Temp\c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4992

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:3312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1068

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:744

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kntbx4y1.jna.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
386f1a3db5ceb3202a0f4a4a97facf99

SHA1
56333a23769866bf17bb7734d98b2395cd8c5dce

SHA256
aa1476a6b4868445701cfcdf946105f7f33093fedbae0b2232f883157b67e443

SHA512
ff551047e0b08127cb2545855805379c7ba4e7393f8dfdee0905ea16ff8eb950a9023440ae2fb75893d519e70facd4d2941739b8f57b848c5fd550031cd79d21

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
2bdf606347f135133eaadf3600576c46

SHA1
c0278541c44c7551d3f8e3540167cdb24b75beae

SHA256
ac079eb77da8d6c91f928d847901cff4cedcf7b3687ea2078977050cab805e09

SHA512
5106406a2e6dcd98c0eecdd66643729f9369271015e9bd3836ec80e369ca287eaf482964dffaf5a127400cc7bd137008fd1dea8308cba7b5f31222dd8525868d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5aeabaf560a9afe977f852656af2390f

SHA1
ff4b23728a06929c0b908158d9b9754f9fab398f

SHA256
7cbdb5b3cb75933217053ebda4047a537e013f8debecf4b3756b2cb605ba7381

SHA512
5009820b3689776bc989df558d8db0c7da15f3a5902136799492a7b308d9d0de2329051c229cc87298811284eb468799ef462ebfc49dd33d5849897fe74b0300

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
72510a5d3aa55ebed09e9ce3bf8746d9

SHA1
e0fdc18f40c3a05ff761237412626180924c8706

SHA256
9b056c4643495ce0566b6c5f04ccd9eecc6c555745c7abf07eb76f17dece90d0

SHA512
89a5fb3aee9c7714509bf05a9b72d252fee2c671dd0d170ced7cab2e0c571d06b9fcf42c6274376fe51e4e5afbd10044e94a1c8ff433710755ab209997ecc183

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
53070900bbd9993c44819de3109d04f4

SHA1
feb9a96c9e9453969d0a5d584bc6f3d36e7fc475

SHA256
b26ac805f984ed1fdeb7fd9dba2fae607bf4f72d1ada53bb11a74855414f7218

SHA512
a6cbe45076f528f1b939c7f65143aa8bd579920525f7dec1b4b6ff73379d911f3adcbd3959688bd52a64d1ff15ed4c22cc2258a7e25dd5c313779595012e1f8e

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
87916ba7d7b5f95c1007925488ffac52

SHA1
c2abc932a51e7e34b456e2fdb1568d749fbafc8e

SHA256
c0d8a1d1aa314bac024308c63cc779529ae083b4e71d25a7da2c6c8757e5cf37

SHA512
8cdd68f5399ff8cf9cb194f0e5b1bfa3ce0dababa7195eaa83b9e74be90b53b474a73ae9f14299b7b2428a066f0fb769a4f6cc7261240ac966186f3c611ffb34

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/2196-1-0x0000000003D40000-0x000000000413B000-memory.dmp

Filesize
4.0MB

Download
memory/2196-3-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/2196-2-0x0000000004140000-0x0000000004A2B000-memory.dmp

Filesize
8.9MB

Download
memory/2196-54-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/2780-268-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2796-42-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/2796-50-0x0000000007960000-0x0000000007968000-memory.dmp

Filesize
32KB

Download
memory/2796-26-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/2796-27-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/2796-28-0x000000007EE10000-0x000000007EE20000-memory.dmp

Filesize
64KB

Download
memory/2796-29-0x0000000007760000-0x0000000007792000-memory.dmp

Filesize
200KB

Download
memory/2796-30-0x0000000070970000-0x00000000709BC000-memory.dmp

Filesize
304KB

Download
memory/2796-31-0x0000000070B10000-0x0000000070E64000-memory.dmp

Filesize
3.3MB

Download
memory/2796-41-0x00000000077A0000-0x00000000077BE000-memory.dmp

Filesize
120KB

Download
memory/2796-24-0x0000000006740000-0x0000000006784000-memory.dmp

Filesize
272KB

Download
memory/2796-43-0x00000000077C0000-0x0000000007863000-memory.dmp

Filesize
652KB

Download
memory/2796-44-0x00000000078B0000-0x00000000078BA000-memory.dmp

Filesize
40KB

Download
memory/2796-45-0x00000000079C0000-0x0000000007A56000-memory.dmp

Filesize
600KB

Download
memory/2796-46-0x00000000078C0000-0x00000000078D1000-memory.dmp

Filesize
68KB

Download
memory/2796-47-0x0000000007900000-0x000000000790E000-memory.dmp

Filesize
56KB

Download
memory/2796-48-0x0000000007920000-0x0000000007934000-memory.dmp

Filesize
80KB

Download
memory/2796-49-0x0000000007970000-0x000000000798A000-memory.dmp

Filesize
104KB

Download
memory/2796-25-0x0000000007510000-0x0000000007586000-memory.dmp

Filesize
472KB

Download
memory/2796-53-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2796-23-0x0000000006210000-0x000000000625C000-memory.dmp

Filesize
304KB

Download
memory/2796-5-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/2796-4-0x0000000004C20000-0x0000000004C56000-memory.dmp

Filesize
216KB

Download
memory/2796-6-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/2796-22-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/2796-21-0x0000000005CE0000-0x0000000006034000-memory.dmp

Filesize
3.3MB

Download
memory/2796-11-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Filesize
408KB

Download
memory/2796-10-0x00000000052A0000-0x0000000005306000-memory.dmp

Filesize
408KB

Download
memory/2796-9-0x0000000005200000-0x0000000005222000-memory.dmp

Filesize
136KB

Download
memory/2796-7-0x00000000053D0000-0x00000000059F8000-memory.dmp

Filesize
6.2MB

Download
memory/2796-8-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3000-270-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-274-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-280-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-154-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3044-56-0x0000000003A60000-0x0000000003E60000-memory.dmp

Filesize
4.0MB

Download
memory/3044-58-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3044-57-0x0000000003E60000-0x000000000474B000-memory.dmp

Filesize
8.9MB

Download
memory/3600-59-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/3600-60-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/3600-92-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/3600-89-0x00000000070A0000-0x00000000070B4000-memory.dmp

Filesize
80KB

Download
memory/3600-85-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/3600-73-0x000000007F020000-0x000000007F030000-memory.dmp

Filesize
64KB

Download
memory/3600-61-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/3600-87-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/3600-88-0x0000000007050000-0x0000000007061000-memory.dmp

Filesize
68KB

Download
memory/3600-71-0x0000000005720000-0x0000000005A74000-memory.dmp

Filesize
3.3MB

Download
memory/3600-72-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Filesize
304KB

Download
memory/3600-74-0x0000000070A70000-0x0000000070ABC000-memory.dmp

Filesize
304KB

Download
memory/3600-75-0x0000000070BF0000-0x0000000070F44000-memory.dmp

Filesize
3.3MB

Download
memory/3600-86-0x0000000006D20000-0x0000000006DC3000-memory.dmp

Filesize
652KB

Download
memory/3716-119-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/3716-107-0x000000007F750000-0x000000007F760000-memory.dmp

Filesize
64KB

Download
memory/3716-94-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/3716-95-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/3716-101-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/3716-108-0x0000000070A70000-0x0000000070ABC000-memory.dmp

Filesize
304KB

Download
memory/3716-122-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/3716-120-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/3716-109-0x0000000070BF0000-0x0000000070F44000-memory.dmp

Filesize
3.3MB

Download
memory/4296-269-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-281-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-259-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-289-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-287-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-285-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-271-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-273-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-283-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-275-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-277-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-279-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4296-260-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4952-135-0x000000007F890000-0x000000007F8A0000-memory.dmp

Filesize
64KB

Download
memory/4952-137-0x0000000070BF0000-0x0000000070F44000-memory.dmp

Filesize
3.3MB

Download
memory/4952-123-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4952-136-0x0000000070A70000-0x0000000070ABC000-memory.dmp

Filesize
304KB

Download
memory/4952-124-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download