glupteba | 39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-05-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Size

4.1MB
MD5

e5aba29e2d3b318fdb690b9c900785c2
SHA1

761a0d77c34ecee7cf05ade41edacf0b0e8768d4
SHA256

39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f
SHA512

9855b2d0d8b6f66cbde1b4d5f42b524990bef87dda443694f2a87d57d309cc02c70901a21033333d950ec445620cb488ca16d0afc56ea4ad499671b1e0875995
SSDEEP

98304:gErTbmYqgZ1XudKeC70JrifsEkbyxLCxltfr4Ppsv6xaCIA:TD1Z1UwAUfrk2xOxPr4PpsvyaCIA

Score

10^/10

glupteba discovery dropper evasion execution loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2112-2-0x0000000004A60000-0x000000000534B000-memory.dmp	family_glupteba
behavioral2/memory/2112-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2112-99-0x0000000004A60000-0x000000000534B000-memory.dmp	family_glupteba
behavioral2/memory/2112-97-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/2112-137-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2788-136-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-201-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-212-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-216-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-220-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-224-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-228-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-233-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-236-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-240-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-244-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-249-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-252-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba
behavioral2/memory/4108-256-0x0000000000400000-0x000000000295D000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3652 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

4108 csrss.exe
2444 injector.exe
768 windefender.exe
8 windefender.exe

pid	process
3652	netsh.exe

pid	process
4108	csrss.exe
2444	injector.exe
768	windefender.exe
8	windefender.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/768-208-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/8-210-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/768-211-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/8-215-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/8-223-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe

Drops file in Windows directory 4 IoCs

Processes:

39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
File created	C:\Windows\rss\csrss.exe	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4548 sc.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

1136 powershell.exe
2712 powershell.exe
4328 powershell.exe
2020 powershell.exe
2900 powershell.exe
4168 powershell.exe
4540 powershell.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

488 schtasks.exe
2828 schtasks.exe

pid	process
4548	sc.exe

pid	process
1136	powershell.exe
2712	powershell.exe
4328	powershell.exe
2020	powershell.exe
2900	powershell.exe
4168	powershell.exe
4540	powershell.exe

pid	process
488	schtasks.exe
2828	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exewindefender.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exepowershell.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
2900	powershell.exe
2900	powershell.exe
2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
4168	powershell.exe
4168	powershell.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
4540	powershell.exe
4540	powershell.exe
1136	powershell.exe
1136	powershell.exe
2712	powershell.exe
2712	powershell.exe
4328	powershell.exe
4328	powershell.exe
2020	powershell.exe
2020	powershell.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
4108	csrss.exe
4108	csrss.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
4108	csrss.exe
4108	csrss.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
4108	csrss.exe
4108	csrss.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe
2444	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Token: SeImpersonatePrivilege	2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeSystemEnvironmentPrivilege	4108	csrss.exe
Token: SeSecurityPrivilege	4548	sc.exe
Token: SeSecurityPrivilege	4548	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 2112 wrote to memory of 2900	2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2112 wrote to memory of 2900	2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2112 wrote to memory of 2900	2112	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4168	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4168	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4168	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 1432	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	cmd.exe
PID 2788 wrote to memory of 1432	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	cmd.exe
PID 1432 wrote to memory of 3652	1432	cmd.exe	netsh.exe
PID 1432 wrote to memory of 3652	1432	cmd.exe	netsh.exe
PID 2788 wrote to memory of 4540	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4540	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4540	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 1136	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 1136	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 1136	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	powershell.exe
PID 2788 wrote to memory of 4108	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	csrss.exe
PID 2788 wrote to memory of 4108	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	csrss.exe
PID 2788 wrote to memory of 4108	2788	39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe	csrss.exe
PID 4108 wrote to memory of 2712	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2712	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2712	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 4328	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 4328	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 4328	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2020	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2020	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2020	4108	csrss.exe	powershell.exe
PID 4108 wrote to memory of 2444	4108	csrss.exe	injector.exe
PID 4108 wrote to memory of 2444	4108	csrss.exe	injector.exe
PID 768 wrote to memory of 2352	768	windefender.exe	cmd.exe
PID 768 wrote to memory of 2352	768	windefender.exe	cmd.exe
PID 768 wrote to memory of 2352	768	windefender.exe	cmd.exe
PID 2352 wrote to memory of 4548	2352	cmd.exe	sc.exe
PID 2352 wrote to memory of 4548	2352	cmd.exe	sc.exe
PID 2352 wrote to memory of 4548	2352	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
"C:\Users\Admin\AppData\Local\Temp\39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Users\Admin\AppData\Local\Temp\39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe
"C:\Users\Admin\AppData\Local\Temp\39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:488

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4820

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2444

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:8

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d14a3pxo.c1d.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3e1fe8384815595e34f2c762a70930bc

SHA1
b939f1deed08a37d9ffefb5475fd467f0227f9cb

SHA256
a080b566af6ef9fc008bd7cb29538535a4724c1c9c560fe60c85328f60b8312f

SHA512
7fa9537b5ea7cc45f3bdce00bf8283f1430e3fa4911d4a5a31de1262193bdd4220734aadcda51673a245bd1cdb539566aa2231df4c50b0be2e52765cab3c2d81

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3505dd10d5d672eba232069b64a4ba61

SHA1
3a7eed001b90ac4bdb2552cfd020b19aa58296e2

SHA256
1efed39d4c695476934393721bf14dea6775ca3f70ae0a550e6566c92f542019

SHA512
8001be537a21261521a4fc64dfcc35ef425b55bd6f4e3207d58c33b40e675c8f923a1f42cfda29390183f0f56e2ef9c7f0f5d89b7c6dfb6f8ef91ba6ffc16102

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
dd070f658c15147d12a8e725ac3e300e

SHA1
cf210c5408296ec19a5b5d918e6d00af5a688925

SHA256
a9e3626902fdc3f8540db6561e8a7d4a4e5e39dde244d0ad607ac391e9fcf8a9

SHA512
4bf5be9ba7f2536458ece94944b88ee876e573658adccec4721a4391a45a7e4225e6d0bf39d5ae62c494a1b01b9a2cc1b588c7da1fda7a2512c99d5ed0b6ba97

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
641d66767f7eddb5c4d92867816dcda3

SHA1
adba13bcfa21957bbd6608b45c4aa4f01832dbcc

SHA256
0c3c6a7095cab6171cbeda5e0ec6ce9008661c7fbe01fad35134ab276046d4ac

SHA512
17c6b36bd2fec820f5a56587abd3557b820d82d93f63f6debcd5c7ec658e41a2196615faa10320c047b64b33f963faa33724b3b3bfeff21a5c9bcf9deb6a6789

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
674ab45fbf5b3552a15d9db431b34c8a

SHA1
abd10fa59839446b7e46b7710130989ab7c1c560

SHA256
7300b6851e36bd77ece07496c1ef5ba776feed55d80f82cc439820d0d4200b77

SHA512
e7463eda56118a218f23cf314f218285db3002c541428bad72ad0790db6f447122fabce48ceaafe07458953b664ff3be5bdf809ec0fb21629f054aabdff19dc8

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.1MB

MD5
e5aba29e2d3b318fdb690b9c900785c2

SHA1
761a0d77c34ecee7cf05ade41edacf0b0e8768d4

SHA256
39f77d05c8a07c4dc9bcdc152cb902acd45c205a949336d3e8a8696d4e53612f

SHA512
9855b2d0d8b6f66cbde1b4d5f42b524990bef87dda443694f2a87d57d309cc02c70901a21033333d950ec445620cb488ca16d0afc56ea4ad499671b1e0875995

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/8-210-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/8-215-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/8-223-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/768-208-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/768-211-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1136-112-0x0000000071120000-0x0000000071477000-memory.dmp

Filesize
3.3MB

Download
memory/1136-111-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

Filesize
304KB

Download
memory/1136-101-0x00000000062E0000-0x0000000006637000-memory.dmp

Filesize
3.3MB

Download
memory/2020-186-0x0000000071040000-0x0000000071397000-memory.dmp

Filesize
3.3MB

Download
memory/2020-185-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

Filesize
304KB

Download
memory/2020-183-0x0000000006150000-0x00000000064A7000-memory.dmp

Filesize
3.3MB

Download
memory/2112-99-0x0000000004A60000-0x000000000534B000-memory.dmp

Filesize
8.9MB

Download
memory/2112-98-0x0000000004660000-0x0000000004A5F000-memory.dmp

Filesize
4.0MB

Download
memory/2112-2-0x0000000004A60000-0x000000000534B000-memory.dmp

Filesize
8.9MB

Download
memory/2112-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2112-137-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2112-97-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/2112-1-0x0000000004660000-0x0000000004A5F000-memory.dmp

Filesize
4.0MB

Download
memory/2712-139-0x0000000071100000-0x0000000071457000-memory.dmp

Filesize
3.3MB

Download
memory/2712-138-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

Filesize
304KB

Download
memory/2788-136-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/2900-7-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/2900-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2900-40-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/2900-39-0x0000000007800000-0x0000000007E7A000-memory.dmp

Filesize
6.5MB

Download
memory/2900-50-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/2900-5-0x0000000002730000-0x0000000002766000-memory.dmp

Filesize
216KB

Download
memory/2900-6-0x0000000005150000-0x000000000577A000-memory.dmp

Filesize
6.2MB

Download
memory/2900-38-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/2900-37-0x00000000070A0000-0x0000000007144000-memory.dmp

Filesize
656KB

Download
memory/2900-8-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Filesize
136KB

Download
memory/2900-25-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

Filesize
304KB

Download
memory/2900-10-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/2900-11-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download
memory/2900-47-0x00000000072F0000-0x00000000072F8000-memory.dmp

Filesize
32KB

Download
memory/2900-46-0x00000000072D0000-0x00000000072EA000-memory.dmp

Filesize
104KB

Download
memory/2900-45-0x0000000007280000-0x0000000007295000-memory.dmp

Filesize
84KB

Download
memory/2900-36-0x0000000007080000-0x000000000709E000-memory.dmp

Filesize
120KB

Download
memory/2900-27-0x0000000071050000-0x00000000713A7000-memory.dmp

Filesize
3.3MB

Download
memory/2900-24-0x0000000007040000-0x0000000007074000-memory.dmp

Filesize
208KB

Download
memory/2900-26-0x0000000074C60000-0x0000000075411000-memory.dmp

Filesize
7.7MB

Download
memory/2900-23-0x00000000061B0000-0x00000000061F6000-memory.dmp

Filesize
280KB

Download
memory/2900-22-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Filesize
304KB

Download
memory/2900-44-0x0000000007270000-0x000000000727E000-memory.dmp

Filesize
56KB

Download
memory/2900-43-0x0000000007220000-0x0000000007231000-memory.dmp

Filesize
68KB

Download
memory/2900-42-0x0000000007310000-0x00000000073A6000-memory.dmp

Filesize
600KB

Download
memory/2900-41-0x0000000007200000-0x000000000720A000-memory.dmp

Filesize
40KB

Download
memory/2900-9-0x0000000005020000-0x0000000005086000-memory.dmp

Filesize
408KB

Download
memory/2900-21-0x0000000005C20000-0x0000000005C3E000-memory.dmp

Filesize
120KB

Download
memory/2900-20-0x0000000005840000-0x0000000005B97000-memory.dmp

Filesize
3.3MB

Download
memory/4108-212-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-256-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-252-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-249-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-244-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-240-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-236-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-233-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-228-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-224-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-201-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-220-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4108-216-0x0000000000400000-0x000000000295D000-memory.dmp

Filesize
37.4MB

Download
memory/4168-71-0x0000000007360000-0x0000000007404000-memory.dmp

Filesize
656KB

Download
memory/4168-57-0x0000000005B40000-0x0000000005E97000-memory.dmp

Filesize
3.3MB

Download
memory/4168-61-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

Filesize
304KB

Download
memory/4168-62-0x0000000071100000-0x0000000071457000-memory.dmp

Filesize
3.3MB

Download
memory/4168-72-0x0000000007670000-0x0000000007681000-memory.dmp

Filesize
68KB

Download
memory/4168-73-0x00000000076C0000-0x00000000076D5000-memory.dmp

Filesize
84KB

Download
memory/4328-157-0x0000000006040000-0x0000000006397000-memory.dmp

Filesize
3.3MB

Download
memory/4328-161-0x0000000071000000-0x0000000071357000-memory.dmp

Filesize
3.3MB

Download
memory/4328-159-0x0000000006600000-0x000000000664C000-memory.dmp

Filesize
304KB

Download
memory/4328-172-0x00000000063D0000-0x00000000063E5000-memory.dmp

Filesize
84KB

Download
memory/4328-171-0x0000000007B90000-0x0000000007BA1000-memory.dmp

Filesize
68KB

Download
memory/4328-170-0x0000000007840000-0x00000000078E4000-memory.dmp

Filesize
656KB

Download
memory/4328-160-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

Filesize
304KB

Download
memory/4540-82-0x00000000055B0000-0x0000000005907000-memory.dmp

Filesize
3.3MB

Download
memory/4540-87-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

Filesize
304KB

Download
memory/4540-88-0x0000000071140000-0x0000000071497000-memory.dmp

Filesize
3.3MB

Download