glupteba | 1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
23-04-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Size

4.2MB
MD5

0dcab1b56d90298a945612d09ce77bda
SHA1

3e917bc6880041f1d5413259120caf94ee17c3be
SHA256

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2
SHA512

d1ecdde17401c6baea7f8aea1dcd5a1866bcde5dde6b06b93eb39a49a277d2d36d2528630f39db4344c4c3d475ac8ac8727966878d0a6cd23a12b774004fd3e9
SSDEEP

98304:Ljy//HaMA0oZdbKSc0+JUZTVnoWtL+8xpWZFuN:7pjD+c6O+8yZ6

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1040-2-0x0000000006690000-0x0000000006F7B000-memory.dmp	family_glupteba
behavioral2/memory/1040-64-0x0000000006690000-0x0000000006F7B000-memory.dmp	family_glupteba
behavioral2/memory/1040-154-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1776-213-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-235-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-238-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-241-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-252-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-256-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-260-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-264-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-268-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-272-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-276-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-280-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-284-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3212-288-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2016 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

3212 csrss.exe
3456 injector.exe
3384 windefender.exe
2424 windefender.exe

pid	process
2016	netsh.exe

pid	process
3212	csrss.exe
3456	injector.exe
3384	windefender.exe
2424	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3384-250-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2424-254-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2424-262-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe

Drops file in Windows directory 4 IoCs

Processes:

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
File created	C:\Windows\rss\csrss.exe	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1156 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4672 schtasks.exe
2236 schtasks.exe

pid	process
1156	sc.exe

pid	process
4672	schtasks.exe
2236	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-152 = "Central America Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exepowershell.exe1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
1532	powershell.exe
1532	powershell.exe
1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1328	powershell.exe
1328	powershell.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
652	powershell.exe
652	powershell.exe
1136	powershell.exe
1136	powershell.exe
4880	powershell.exe
4880	powershell.exe
1240	powershell.exe
1240	powershell.exe
2980	powershell.exe
2980	powershell.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3212	csrss.exe
3212	csrss.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3212	csrss.exe
3212	csrss.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe
3456	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Token: SeImpersonatePrivilege	1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeSystemEnvironmentPrivilege	3212	csrss.exe
Token: SeSecurityPrivilege	1156	sc.exe
Token: SeSecurityPrivilege	1156	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 1040 wrote to memory of 1532	1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1040 wrote to memory of 1532	1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1040 wrote to memory of 1532	1040	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1328	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1328	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1328	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 2160	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	cmd.exe
PID 1776 wrote to memory of 2160	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	cmd.exe
PID 2160 wrote to memory of 2016	2160	cmd.exe	netsh.exe
PID 2160 wrote to memory of 2016	2160	cmd.exe	netsh.exe
PID 1776 wrote to memory of 652	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 652	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 652	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1136	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1136	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 1136	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	powershell.exe
PID 1776 wrote to memory of 3212	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	csrss.exe
PID 1776 wrote to memory of 3212	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	csrss.exe
PID 1776 wrote to memory of 3212	1776	1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe	csrss.exe
PID 3212 wrote to memory of 4880	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 4880	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 4880	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 1240	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 1240	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 1240	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 2980	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 2980	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 2980	3212	csrss.exe	powershell.exe
PID 3212 wrote to memory of 3456	3212	csrss.exe	injector.exe
PID 3212 wrote to memory of 3456	3212	csrss.exe	injector.exe
PID 3384 wrote to memory of 5008	3384	windefender.exe	cmd.exe
PID 3384 wrote to memory of 5008	3384	windefender.exe	cmd.exe
PID 3384 wrote to memory of 5008	3384	windefender.exe	cmd.exe
PID 5008 wrote to memory of 1156	5008	cmd.exe	sc.exe
PID 5008 wrote to memory of 1156	5008	cmd.exe	sc.exe
PID 5008 wrote to memory of 1156	5008	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
"C:\Users\Admin\AppData\Local\Temp\1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Users\Admin\AppData\Local\Temp\1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe
"C:\Users\Admin\AppData\Local\Temp\1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2016

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4672

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:1248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3456

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2236

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_diywvmiv.hzq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
39fd8e1e6dd01603bb707e5fa4c6b34d

SHA1
8038f1f9c873cd5ec851bdd2b680b8813731b39f

SHA256
155b99221f14dff0bd83cd056bb5b303a30ace54b1579d17bac53c26a036db2b

SHA512
006f765c8a595088b45c98d95014414e6ba95db9cd76d80cbf03fe6c35fd74ae4dce885361e20cd3bffa9d16ac3520fd46a758cf98a1f4398caf168930cf6cb8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
89e8d28d50e9e259e62fda7ac2c8a9df

SHA1
0ed8682d41757b4cf58885753864755ae3f20e8a

SHA256
abd08cf1e5b1fcc34e292331fb2089cd868a5fcc11975181056631e3c675a61d

SHA512
b6449367c91f58eabf2c922912e63d70443fa5e33b75300054ec4412f5fa9108798bc154b57416f0aa812d2a75b455570297897955f44371a65af2b3a4205971

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
77b5e32f5e8e20d0076708ef54402f80

SHA1
730836d17ccfa3aef9c9662c605c4153bcebaace

SHA256
f65ea7b3ed4403fbd327cc164c2911fa3b8ef872565f3945655835b45e46a4c7

SHA512
7084b2283b780afc1fac235fb7c031647072c028ea703747b1e99d13aa6e009dfd48e3ce07f221ca0283f32e683c1ba8f67980628447ecec187b9e70f6bda76b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e6398462f64e672398a1400f1ac97705

SHA1
41ee59cc5dfd920a1c1f6bd9b200a65369b2a015

SHA256
7d3661d79e274b6e3fbf1c811c544fd4d51463a74fcafe8b51a4a1ecef95eb28

SHA512
c1f0ff4d58b20e05e1be0cb03cc2831e6c96e49acc68461fc6c430e0612a7f4a1bf155c6f4153bd587428f71b6ee14996bdc80fd8b00226b690e079877428d6d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
9cf80d1f96eb539c08733aeca6f92d61

SHA1
63168295eb2b4610828295393574abaf84c5cf81

SHA256
06c6642142e058ea20624838664d4d2654a39401424b8056eabf5831f55f7cf8

SHA512
59a0d2116e25e4f05dc69b031bc3c6189181f67fc70f01be2ef96c6cee7e25bfc0e29c938c9b25909f8d1eba851370f5e271ce1d1c0bdef03b44c22f3601ba2b

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
0dcab1b56d90298a945612d09ce77bda

SHA1
3e917bc6880041f1d5413259120caf94ee17c3be

SHA256
1a0703587ffd3573298319775c2eec8025f75942d749c641059944960ea2f4d2

SHA512
d1ecdde17401c6baea7f8aea1dcd5a1866bcde5dde6b06b93eb39a49a277d2d36d2528630f39db4344c4c3d475ac8ac8727966878d0a6cd23a12b774004fd3e9

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/652-109-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/652-97-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Filesize
304KB

Download
memory/652-107-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/652-98-0x0000000070D20000-0x0000000071077000-memory.dmp

Filesize
3.3MB

Download
memory/652-96-0x000000007F220000-0x000000007F230000-memory.dmp

Filesize
64KB

Download
memory/652-84-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/652-85-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/652-86-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1040-154-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/1040-51-0x0000000004AF0000-0x0000000004EEE000-memory.dmp

Filesize
4.0MB

Download
memory/1040-2-0x0000000006690000-0x0000000006F7B000-memory.dmp

Filesize
8.9MB

Download
memory/1040-1-0x0000000004AF0000-0x0000000004EEE000-memory.dmp

Filesize
4.0MB

Download
memory/1040-64-0x0000000006690000-0x0000000006F7B000-memory.dmp

Filesize
8.9MB

Download
memory/1136-135-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1136-133-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/1136-123-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Filesize
304KB

Download
memory/1136-124-0x0000000070D20000-0x0000000071077000-memory.dmp

Filesize
3.3MB

Download
memory/1136-110-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1136-113-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/1136-112-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/1328-82-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1328-78-0x00000000072F0000-0x0000000007301000-memory.dmp

Filesize
68KB

Download
memory/1328-79-0x0000000007340000-0x0000000007355000-memory.dmp

Filesize
84KB

Download
memory/1328-52-0x00000000058A0000-0x0000000005BF7000-memory.dmp

Filesize
3.3MB

Download
memory/1328-53-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1328-55-0x00000000048E0000-0x00000000048F0000-memory.dmp

Filesize
64KB

Download
memory/1328-63-0x00000000048E0000-0x00000000048F0000-memory.dmp

Filesize
64KB

Download
memory/1328-77-0x0000000006FA0000-0x0000000007044000-memory.dmp

Filesize
656KB

Download
memory/1328-66-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Filesize
304KB

Download
memory/1328-67-0x0000000070D20000-0x0000000071077000-memory.dmp

Filesize
3.3MB

Download
memory/1328-65-0x000000007F6C0000-0x000000007F6D0000-memory.dmp

Filesize
64KB

Download
memory/1328-70-0x00000000048E0000-0x00000000048F0000-memory.dmp

Filesize
64KB

Download
memory/1532-10-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/1532-6-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/1532-48-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1532-45-0x0000000007950000-0x0000000007958000-memory.dmp

Filesize
32KB

Download
memory/1532-26-0x0000000070C50000-0x0000000070FA7000-memory.dmp

Filesize
3.3MB

Download
memory/1532-24-0x0000000007630000-0x0000000007664000-memory.dmp

Filesize
208KB

Download
memory/1532-25-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Filesize
304KB

Download
memory/1532-23-0x000000007F0F0000-0x000000007F100000-memory.dmp

Filesize
64KB

Download
memory/1532-22-0x00000000067C0000-0x0000000006806000-memory.dmp

Filesize
280KB

Download
memory/1532-21-0x0000000006250000-0x000000000629C000-memory.dmp

Filesize
304KB

Download
memory/1532-20-0x0000000006200000-0x000000000621E000-memory.dmp

Filesize
120KB

Download
memory/1532-19-0x0000000005DA0000-0x00000000060F7000-memory.dmp

Filesize
3.3MB

Download
memory/1532-35-0x0000000007670000-0x000000000768E000-memory.dmp

Filesize
120KB

Download
memory/1532-9-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/1532-43-0x0000000007870000-0x0000000007885000-memory.dmp

Filesize
84KB

Download
memory/1532-44-0x0000000007970000-0x000000000798A000-memory.dmp

Filesize
104KB

Download
memory/1532-8-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/1532-3-0x0000000004D50000-0x0000000004D86000-memory.dmp

Filesize
216KB

Download
memory/1532-42-0x0000000007860000-0x000000000786E000-memory.dmp

Filesize
56KB

Download
memory/1532-41-0x0000000007820000-0x0000000007831000-memory.dmp

Filesize
68KB

Download
memory/1532-40-0x00000000078B0000-0x0000000007946000-memory.dmp

Filesize
600KB

Download
memory/1532-39-0x00000000077F0000-0x00000000077FA000-memory.dmp

Filesize
40KB

Download
memory/1532-37-0x0000000007E00000-0x000000000847A000-memory.dmp

Filesize
6.5MB

Download
memory/1532-4-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download
memory/1532-7-0x0000000005530000-0x0000000005B5A000-memory.dmp

Filesize
6.2MB

Download
memory/1532-36-0x0000000007690000-0x0000000007734000-memory.dmp

Filesize
656KB

Download
memory/1532-5-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/1532-38-0x00000000077B0000-0x00000000077CA000-memory.dmp

Filesize
104KB

Download
memory/1776-50-0x0000000004B30000-0x0000000004F2B000-memory.dmp

Filesize
4.0MB

Download
memory/1776-213-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/1776-111-0x0000000004B30000-0x0000000004F2B000-memory.dmp

Filesize
4.0MB

Download
memory/2424-254-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2424-262-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3212-260-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-238-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-241-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-235-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-141-0x0000000005000000-0x0000000005400000-memory.dmp

Filesize
4.0MB

Download
memory/3212-252-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-284-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-256-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-288-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-280-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-264-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-268-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-272-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3212-276-0x0000000000400000-0x0000000004426000-memory.dmp

Filesize
64.1MB

Download
memory/3384-250-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4880-143-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4880-142-0x0000000074860000-0x0000000075011000-memory.dmp

Filesize
7.7MB

Download