glupteba | c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03

Analysis

max time kernel
9s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
18-05-2024 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Size

4.1MB
MD5

5d554990f88d73556fb9c539884a5ebe
SHA1

627b5540b78befb90725af0a8ec5ce3c57e08c72
SHA256

c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03
SHA512

f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291
SSDEEP

98304:BsVQ+hudF4keJeyEqK0evsENr9r54Wa5Cc1nHXivv:Bs5hioeyE6OsERj43n4

Score

10^/10

glupteba dropper evasion execution loader persistence upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

resource	yara_rule
behavioral2/memory/1788-2-0x00000000048D0000-0x00000000051BB000-memory.dmp	family_glupteba
behavioral2/memory/1788-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1612-122-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1788-145-0x00000000048D0000-0x00000000051BB000-memory.dmp	family_glupteba
behavioral2/memory/1788-144-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1788-197-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1516-199-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-209-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-212-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-216-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-219-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-221-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-224-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-228-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-231-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-233-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-236-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-240-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba
behavioral2/memory/1516-243-0x0000000000400000-0x0000000002732000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2280	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1516	csrss.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4984-204-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000200000002aa07-203.dat	upx
behavioral2/memory/4984-208-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4960-207-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4960-211-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4960-217-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4960-226-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
File opened for modification	C:\Windows\rss	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2492	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3168	powershell.exe
3152	powershell.exe
4444	powershell.exe
3668	powershell.exe
1372	powershell.exe
3456	powershell.exe
1104	powershell.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
648	schtasks.exe
3116	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3456	powershell.exe
3456	powershell.exe
1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1104	powershell.exe
1104	powershell.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
3168	powershell.exe
3168	powershell.exe
3152	powershell.exe
3152	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Token: SeImpersonatePrivilege	1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 3456	1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	78
PID 1788 wrote to memory of 3456	1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	78
PID 1788 wrote to memory of 3456	1788	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	78
PID 1612 wrote to memory of 1104	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	83
PID 1612 wrote to memory of 1104	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	83
PID 1612 wrote to memory of 1104	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	83
PID 1612 wrote to memory of 4668	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	85
PID 1612 wrote to memory of 4668	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	85
PID 4668 wrote to memory of 2280	4668	cmd.exe	87
PID 4668 wrote to memory of 2280	4668	cmd.exe	87
PID 1612 wrote to memory of 3168	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	88
PID 1612 wrote to memory of 3168	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	88
PID 1612 wrote to memory of 3168	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	88
PID 1612 wrote to memory of 3152	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	90
PID 1612 wrote to memory of 3152	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	90
PID 1612 wrote to memory of 3152	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	90
PID 1612 wrote to memory of 1516	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	92
PID 1612 wrote to memory of 1516	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	92
PID 1612 wrote to memory of 1516	1612	c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe	92
PID 1516 wrote to memory of 4444	1516	csrss.exe	93
PID 1516 wrote to memory of 4444	1516	csrss.exe	93
PID 1516 wrote to memory of 4444	1516	csrss.exe	93

C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
"C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
  "C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2280
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3116
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:2164
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:648
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:4984
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:3820
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:2492

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4mgc0otk.ly1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
93d18ab6e41cde6c39c3e6895cfad521

SHA1
f7569a022bd18521ed95132c81638e211463fae2

SHA256
9f58b6dc1ef9fc7e059a515cdb7c0eff1b1ae480f3085a3766cc21af8f212bde

SHA512
8526285c783fed49e66f33a8d8febe12bf03e90e78ff8de817aefd4b5b7b3027864dd607e250c40a0f4b96d7e9cc7c1398845c7e5f35b6f2e36882b1e7ef9c56

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b5d306e54b75aa0216c67a4f172a406d

SHA1
b9050e7e62b679559044b630f9528290f942862f

SHA256
0970d51ac660b62b81501d4b1aa2b6ff1280cca2793bdf0b8ea046ca406a65f9

SHA512
ee4424613287f5cc9e1230b8c150b17a581946630865c41927fea8d388cf79cb2e43a290d6b46d05de2763dbe69cdb43fafefb36b2a78dad527acd78523c3649

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1e35cf600182175e745dfea7c2d22a79

SHA1
e1246e494583a085fce5a4417489f420c573aa41

SHA256
12bf8bf7b29cedf31cd3396e2fd24949b908b9aee43b8b68ff3dd7b4135a4442

SHA512
2ab01815778ef3acdb54e94efaccc399d3b4928c1ca0cb854593e4f5769c80c5a71a84af4b1670dcf6ce6740c9104e655c3af436ae51168bb3162fb5d7714b19

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
205d3fd9345db97d466ed14e04550afb

SHA1
bf81e3011e5c8882783bfddbf2fe9f7152e2ea83

SHA256
0837d0dd4ab9fc83fda180518915700c423ef614f558bd38f1013e06f43535a2

SHA512
9c445ab058da06ee770a1bc4f6e76d0a657aef9d005c3370e6c929830445e6afaee972b15f4c4b639b90ab0cba1ddd47766e658f56ccb99648574622804245a2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
381ca2a95daedd25213d2801696cfe53

SHA1
a5b13d6512bfd80d3f1f8d34f05347a8f5803d0f

SHA256
d472cade3df0e1d63b7c71db2ae1ca4d15cf552aaccfba72318937faaee19e86

SHA512
e0a660f1d55de0b8a5d649902b63337792dbb319bf444e555752e1b47f60adc59e321805515f684ab6c2f48f1d32cbef79194486d83c15a2db8eb2c1dcbe45b7

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
5d554990f88d73556fb9c539884a5ebe

SHA1
627b5540b78befb90725af0a8ec5ce3c57e08c72

SHA256
c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03

SHA512
f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1104-62-0x0000000070D50000-0x00000000710A7000-memory.dmp

Filesize
3.3MB

Download
memory/1104-71-0x0000000007650000-0x00000000076F4000-memory.dmp

Filesize
656KB

Download
memory/1104-61-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Filesize
304KB

Download
memory/1104-72-0x00000000079A0000-0x00000000079B1000-memory.dmp

Filesize
68KB

Download
memory/1104-73-0x00000000079E0000-0x00000000079F5000-memory.dmp

Filesize
84KB

Download
memory/1104-60-0x0000000006060000-0x00000000063B7000-memory.dmp

Filesize
3.3MB

Download
memory/1372-179-0x0000000005B70000-0x0000000005EC7000-memory.dmp

Filesize
3.3MB

Download
memory/1372-182-0x0000000070D00000-0x0000000071057000-memory.dmp

Filesize
3.3MB

Download
memory/1372-181-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Filesize
304KB

Download
memory/1516-231-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-209-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-219-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-233-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-221-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-224-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-236-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-240-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-243-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-199-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-228-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-212-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1516-216-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1612-122-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1788-97-0x00000000044D0000-0x00000000048CC000-memory.dmp

Filesize
4.0MB

Download
memory/1788-144-0x0000000000400000-0x0000000002732000-memory.dmp

Filesize
35.2MB

Download
memory/1788-197-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1788-145-0x00000000048D0000-0x00000000051BB000-memory.dmp

Filesize
8.9MB

Download
memory/1788-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1788-2-0x00000000048D0000-0x00000000051BB000-memory.dmp

Filesize
8.9MB

Download
memory/1788-1-0x00000000044D0000-0x00000000048CC000-memory.dmp

Filesize
4.0MB

Download
memory/3152-109-0x0000000070E20000-0x0000000071177000-memory.dmp

Filesize
3.3MB

Download
memory/3152-108-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Filesize
304KB

Download
memory/3168-77-0x00000000061B0000-0x0000000006507000-memory.dmp

Filesize
3.3MB

Download
memory/3168-87-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Filesize
304KB

Download
memory/3168-88-0x0000000070E20000-0x0000000071177000-memory.dmp

Filesize
3.3MB

Download
memory/3456-4-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/3456-50-0x0000000074960000-0x0000000075111000-memory.dmp

Filesize
7.7MB

Download
memory/3456-43-0x0000000007850000-0x0000000007861000-memory.dmp

Filesize
68KB

Download
memory/3456-41-0x0000000007830000-0x000000000783A000-memory.dmp

Filesize
40KB

Download
memory/3456-40-0x00000000077F0000-0x000000000780A000-memory.dmp

Filesize
104KB

Download
memory/3456-26-0x0000000074960000-0x0000000075111000-memory.dmp

Filesize
7.7MB

Download
memory/3456-44-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/3456-45-0x00000000078B0000-0x00000000078C5000-memory.dmp

Filesize
84KB

Download
memory/3456-46-0x0000000007900000-0x000000000791A000-memory.dmp

Filesize
104KB

Download
memory/3456-20-0x0000000005DA0000-0x00000000060F7000-memory.dmp

Filesize
3.3MB

Download
memory/3456-27-0x0000000070D60000-0x00000000710B7000-memory.dmp

Filesize
3.3MB

Download
memory/3456-42-0x0000000007940000-0x00000000079D6000-memory.dmp

Filesize
600KB

Download
memory/3456-5-0x0000000002A50000-0x0000000002A86000-memory.dmp

Filesize
216KB

Download
memory/3456-7-0x0000000074960000-0x0000000075111000-memory.dmp

Filesize
7.7MB

Download
memory/3456-6-0x00000000055D0000-0x0000000005BFA000-memory.dmp

Filesize
6.2MB

Download
memory/3456-39-0x0000000007E30000-0x00000000084AA000-memory.dmp

Filesize
6.5MB

Download
memory/3456-8-0x0000000074960000-0x0000000075111000-memory.dmp

Filesize
7.7MB

Download
memory/3456-38-0x0000000074960000-0x0000000075111000-memory.dmp

Filesize
7.7MB

Download
memory/3456-36-0x00000000076A0000-0x00000000076BE000-memory.dmp

Filesize
120KB

Download
memory/3456-37-0x00000000076C0000-0x0000000007764000-memory.dmp

Filesize
656KB

Download
memory/3456-24-0x0000000007660000-0x0000000007694000-memory.dmp

Filesize
208KB

Download
memory/3456-25-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Filesize
304KB

Download
memory/3456-47-0x0000000007920000-0x0000000007928000-memory.dmp

Filesize
32KB

Download
memory/3456-23-0x00000000067E0000-0x0000000006826000-memory.dmp

Filesize
280KB

Download
memory/3456-9-0x0000000005390000-0x00000000053B2000-memory.dmp

Filesize
136KB

Download
memory/3456-22-0x00000000062C0000-0x000000000630C000-memory.dmp

Filesize
304KB

Download
memory/3456-10-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/3456-11-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/3456-21-0x0000000006260000-0x000000000627E000-memory.dmp

Filesize
120KB

Download
memory/3668-168-0x0000000007280000-0x0000000007291000-memory.dmp

Filesize
68KB

Download
memory/3668-167-0x0000000006F60000-0x0000000007004000-memory.dmp

Filesize
656KB

Download
memory/3668-156-0x0000000006290000-0x00000000062DC000-memory.dmp

Filesize
304KB

Download
memory/3668-157-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Filesize
304KB

Download
memory/3668-169-0x0000000005A80000-0x0000000005A95000-memory.dmp

Filesize
84KB

Download
memory/3668-158-0x0000000070D60000-0x00000000710B7000-memory.dmp

Filesize
3.3MB

Download
memory/4444-135-0x0000000070D50000-0x00000000710A7000-memory.dmp

Filesize
3.3MB

Download
memory/4444-134-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Filesize
304KB

Download
memory/4960-226-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4960-211-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4960-217-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4960-207-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4984-204-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4984-208-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download