glupteba | 1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
23-04-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Size

4.2MB
MD5

9dc832b94e5fa7e79596545b846d70b9
SHA1

2e90ffe5acb9eaf58a756c4bad524e991101f0e3
SHA256

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78
SHA512

edad0725d16975fb3365f139849d1f0c946cbd89637ec3e7c27920db00036880d8761d170d95de43b60aea6cce39150d03bf4c324cf255999d20b6b295f69774
SSDEEP

98304:q9dcOUBEbybSH36R/JhlYZJkRBAK/yVZyNfNI1XCYNES:oyBJSqZXeZGRgrygZb

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4052-2-0x00000000066A0000-0x0000000006F8B000-memory.dmp	family_glupteba
behavioral2/memory/4052-62-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/4052-74-0x00000000066A0000-0x0000000006F8B000-memory.dmp	family_glupteba
behavioral2/memory/2492-141-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-226-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-241-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-256-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-274-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-290-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-306-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-322-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3844-344-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2248 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

3844 csrss.exe

pid	process
2248	netsh.exe

pid	process
3844	csrss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1576-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3104-288-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3104-320-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe

Drops file in Windows directory 2 IoCs

Processes:

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe

description	ioc	process
File opened for modification	C:\Windows\rss	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
File created	C:\Windows\rss\csrss.exe	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2088 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3004 schtasks.exe
4908 schtasks.exe

pid	process
2088	sc.exe

pid	process
3004	schtasks.exe
4908	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exepowershell.exe1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.exe

pid	process
3484	powershell.exe
3484	powershell.exe
4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
464	powershell.exe
464	powershell.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
3144	powershell.exe
3144	powershell.exe
2336	powershell.exe
2336	powershell.exe
3524	powershell.exe
3524	powershell.exe
648	powershell.exe
648	powershell.exe
4204	powershell.exe
4204	powershell.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe
2720	injector.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exe1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesc.exe

description	pid	process
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Token: SeImpersonatePrivilege	4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeSecurityPrivilege	2088	sc.exe
Token: SeSecurityPrivilege	2088	sc.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.execmd.exewindefender.execmd.exe

description	pid	process	target process
PID 4052 wrote to memory of 3484	4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 4052 wrote to memory of 3484	4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 4052 wrote to memory of 3484	4052	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 464	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 464	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 464	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 4156	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	cmd.exe
PID 2492 wrote to memory of 4156	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	cmd.exe
PID 4156 wrote to memory of 2248	4156	cmd.exe	netsh.exe
PID 4156 wrote to memory of 2248	4156	cmd.exe	netsh.exe
PID 2492 wrote to memory of 3144	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 3144	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 3144	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 2336	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 2336	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 2336	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	powershell.exe
PID 2492 wrote to memory of 3844	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	csrss.exe
PID 2492 wrote to memory of 3844	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	csrss.exe
PID 2492 wrote to memory of 3844	2492	1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe	csrss.exe
PID 1576 wrote to memory of 4240	1576	windefender.exe	cmd.exe
PID 1576 wrote to memory of 4240	1576	windefender.exe	cmd.exe
PID 1576 wrote to memory of 4240	1576	windefender.exe	cmd.exe
PID 4240 wrote to memory of 2088	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 2088	4240	cmd.exe	sc.exe
PID 4240 wrote to memory of 2088	4240	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
"C:\Users\Admin\AppData\Local\Temp\1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Users\Admin\AppData\Local\Temp\1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe
"C:\Users\Admin\AppData\Local\Temp\1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3004

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:2308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4908

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Modifies data under HKEY_USERS
PID:3104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxcjsobz.n1e.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
469120b73ed2abfb3c214935145c9a4f

SHA1
b08f8bebbda0f01a99437f61c6ce211e30ca4261

SHA256
f33b5ae7c4fbae72a5ba165476f5f69ca6d6732af94e478ef019fd6b6432d9c3

SHA512
f0a808f67d8cdf1f4b0c608aca695c343843222ebb851f1077e9a962c6b51078da79d7ec50e0414dd1a77b1944930ff32ff81ce0d24aa09c11fa3f93583261c9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
d8313a714e9059d30d6d6366d737ef6c

SHA1
a382ffdb60c63b0ffd836658a058e05eb738d18f

SHA256
714a253bef6472aa0c02d9651097da5afce47e35b4048b9afcc90d95970c0629

SHA512
ba7c34cafbd4e6a58ee27d80024ee1bb63e7a04138dc4e2ed52fdcd38b8194ae6b80a8a3f7c854a05ca852c45410ccfd44dd09f7463566b95facfa9979636af2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
a7622712172b0140690ba97633c2a64a

SHA1
257f37ce9bf08dce09a1bc8ea64c0588b6d69d5c

SHA256
5e708f8b21bdbdf5f7d0ebab935deb7c301166b606e9ad918189949b1931b745

SHA512
33979b5a990bba213ac009b153c6861939171ea889fdf3a439bac54b21ba643641db1ef8a3dcd0b0cad3461f21c2172aa024204598080d82f3148913b8a2eadc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
9f23c54647dd2368277c6b292df23328

SHA1
604ea806487eddabe85d0a80308b36a21be75939

SHA256
f9b4640e3ea8e2da0d2b7447e46a5059fad90497cf89169e82ef865f8e43dee7

SHA512
9c19c39ebb59f4be351ac14e96469c10baf2d50d986429abc8d2c8dd7dea85003c7daaa97c0f67dd79411723f55ebbb26295b8d8a3a25b17a672a18f572ac6b5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5879ca60a578f214bc9b02be6595559a

SHA1
edfd9910febc02cc3e2cde0e7fa059d9d669d4e8

SHA256
6e43215b8a7a5741b15db3b19202cc2d11a3daeeea6e33b12442495a9929eb71

SHA512
d2f092259f5c0af4c66d1cf070f2290aefe4edf2c7860e1a355e26950e145deacb5c2215b987ff8eaef8b04d3eaaa15c858aedb9c9b0fa1e820a94e2c32441bc

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
9dc832b94e5fa7e79596545b846d70b9

SHA1
2e90ffe5acb9eaf58a756c4bad524e991101f0e3

SHA256
1a3a6ac78eb72acfc2123cbc9329b060c1eeaca7cc6f09e1bc48622474c85c78

SHA512
edad0725d16975fb3365f139849d1f0c946cbd89637ec3e7c27920db00036880d8761d170d95de43b60aea6cce39150d03bf4c324cf255999d20b6b295f69774

Download Submit
memory/464-82-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/464-52-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/464-79-0x0000000007710000-0x0000000007725000-memory.dmp

Filesize
84KB

Download
memory/464-78-0x00000000076C0000-0x00000000076D1000-memory.dmp

Filesize
68KB

Download
memory/464-77-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/464-76-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/464-75-0x000000007F610000-0x000000007F620000-memory.dmp

Filesize
64KB

Download
memory/464-73-0x0000000007190000-0x0000000007234000-memory.dmp

Filesize
656KB

Download
memory/464-64-0x0000000070960000-0x0000000070CB7000-memory.dmp

Filesize
3.3MB

Download
memory/464-63-0x00000000707E0000-0x000000007082C000-memory.dmp

Filesize
304KB

Download
memory/464-53-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/1576-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2336-135-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2336-124-0x000000007F0D0000-0x000000007F0E0000-memory.dmp

Filesize
64KB

Download
memory/2336-111-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/2336-113-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2336-122-0x0000000005940000-0x0000000005C97000-memory.dmp

Filesize
3.3MB

Download
memory/2336-137-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/2336-126-0x00000000709F0000-0x0000000070D47000-memory.dmp

Filesize
3.3MB

Download
memory/2336-125-0x00000000707E0000-0x000000007082C000-memory.dmp

Filesize
304KB

Download
memory/2492-50-0x0000000004930000-0x0000000004D2B000-memory.dmp

Filesize
4.0MB

Download
memory/2492-141-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/2492-112-0x0000000004930000-0x0000000004D2B000-memory.dmp

Filesize
4.0MB

Download
memory/3104-320-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3104-288-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3144-108-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/3144-110-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/3144-84-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/3144-107-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/3144-98-0x0000000070A30000-0x0000000070D87000-memory.dmp

Filesize
3.3MB

Download
memory/3144-96-0x000000007F9D0000-0x000000007F9E0000-memory.dmp

Filesize
64KB

Download
memory/3144-97-0x00000000707E0000-0x000000007082C000-memory.dmp

Filesize
304KB

Download
memory/3144-94-0x0000000005AD0000-0x0000000005E27000-memory.dmp

Filesize
3.3MB

Download
memory/3144-85-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/3484-4-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/3484-36-0x0000000007110000-0x00000000071B4000-memory.dmp

Filesize
656KB

Download
memory/3484-19-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/3484-16-0x0000000005760000-0x0000000005AB7000-memory.dmp

Filesize
3.3MB

Download
memory/3484-9-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/3484-21-0x0000000006200000-0x0000000006246000-memory.dmp

Filesize
280KB

Download
memory/3484-23-0x00000000070B0000-0x00000000070E4000-memory.dmp

Filesize
208KB

Download
memory/3484-22-0x000000007F280000-0x000000007F290000-memory.dmp

Filesize
64KB

Download
memory/3484-8-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/3484-38-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/3484-39-0x0000000007270000-0x000000000727A000-memory.dmp

Filesize
40KB

Download
memory/3484-24-0x00000000707E0000-0x000000007082C000-memory.dmp

Filesize
304KB

Download
memory/3484-25-0x0000000070960000-0x0000000070CB7000-memory.dmp

Filesize
3.3MB

Download
memory/3484-34-0x00000000048A0000-0x00000000048B0000-memory.dmp

Filesize
64KB

Download
memory/3484-35-0x00000000070F0000-0x000000000710E000-memory.dmp

Filesize
120KB

Download
memory/3484-37-0x0000000007880000-0x0000000007EFA000-memory.dmp

Filesize
6.5MB

Download
memory/3484-20-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Filesize
304KB

Download
memory/3484-48-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/3484-45-0x0000000007360000-0x0000000007368000-memory.dmp

Filesize
32KB

Download
memory/3484-7-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Filesize
136KB

Download
memory/3484-44-0x0000000007340000-0x000000000735A000-memory.dmp

Filesize
104KB

Download
memory/3484-43-0x00000000072F0000-0x0000000007305000-memory.dmp

Filesize
84KB

Download
memory/3484-42-0x00000000072E0000-0x00000000072EE000-memory.dmp

Filesize
56KB

Download
memory/3484-3-0x00000000047E0000-0x0000000004816000-memory.dmp

Filesize
216KB

Download
memory/3484-41-0x00000000072A0000-0x00000000072B1000-memory.dmp

Filesize
68KB

Download
memory/3484-6-0x0000000004EE0000-0x000000000550A000-memory.dmp

Filesize
6.2MB

Download
memory/3484-40-0x0000000007380000-0x0000000007416000-memory.dmp

Filesize
600KB

Download
memory/3484-5-0x00000000048A0000-0x00000000048B0000-memory.dmp

Filesize
64KB

Download
memory/3524-151-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/3524-150-0x0000000074570000-0x0000000074D21000-memory.dmp

Filesize
7.7MB

Download
memory/3844-230-0x0000000074DD0000-0x0000000074DEE000-memory.dmp

Filesize
120KB

Download
memory/3844-256-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-226-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-228-0x0000000074DF0000-0x0000000074E57000-memory.dmp

Filesize
412KB

Download
memory/3844-344-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-231-0x0000000074DB0000-0x0000000074DC1000-memory.dmp

Filesize
68KB

Download
memory/3844-241-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-243-0x0000000074DF0000-0x0000000074E57000-memory.dmp

Filesize
412KB

Download
memory/3844-248-0x0000000074D60000-0x0000000074DA1000-memory.dmp

Filesize
260KB

Download
memory/3844-322-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-306-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-274-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3844-290-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/4052-62-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/4052-2-0x00000000066A0000-0x0000000006F8B000-memory.dmp

Filesize
8.9MB

Download
memory/4052-74-0x00000000066A0000-0x0000000006F8B000-memory.dmp

Filesize
8.9MB

Download
memory/4052-1-0x0000000004B00000-0x0000000004EFC000-memory.dmp

Filesize
4.0MB

Download
memory/4052-51-0x0000000004B00000-0x0000000004EFC000-memory.dmp

Filesize
4.0MB

Download