glupteba | 73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080

Analysis

max time kernel
9s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Size

4.1MB
MD5

fee04bb4f2890f2e90b4b12de4b729c8
SHA1

2fcf87cec6fa8ce956b0442eab3a1335f48ce3f2
SHA256

73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080
SHA512

00ca03e958789e5c41060d7dec99cdc88e00c88dcd2653f2e0370bb42066c1f687cc304391ca9f891c445d858000675eda402985057314bbbf20a184c2abfb36
SSDEEP

98304:b7sgfTqZm7fywQIpjGUn+cmloZHued8miXbTsPufBvNF:bzgmDywQg+foZ8mw6Sb

Score

10^/10

glupteba dropper evasion execution loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2084-2-0x0000000004A10000-0x00000000052FB000-memory.dmp	family_glupteba
behavioral2/memory/2084-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3980-123-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/2084-127-0x0000000004A10000-0x00000000052FB000-memory.dmp	family_glupteba
behavioral2/memory/2084-125-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/2084-195-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4304-202-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-215-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-218-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-221-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-224-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-227-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-230-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-233-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-236-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-239-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-242-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba
behavioral2/memory/4304-245-0x0000000000400000-0x0000000002733000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
1796	netsh.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x000200000002a9cf-205.dat	upx
behavioral2/memory/4928-207-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4928-210-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2724-209-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2724-213-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2724-219-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2724-228-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

Processes:

73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
2412	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2508	powershell.exe
4084	powershell.exe
1516	powershell.exe
4720	powershell.exe
2804	powershell.exe
3452	powershell.exe
2232	powershell.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
1664	schtasks.exe
3944	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exepowershell.exepowershell.exepowershell.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exe73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exepowershell.exe73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exepowershell.exepowershell.exe

pid	Process
4720	powershell.exe
4720	powershell.exe
2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
2804	powershell.exe
2804	powershell.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
3452	powershell.exe
3452	powershell.exe
2232	powershell.exe
2232	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exe73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Token: SeImpersonatePrivilege	2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.execmd.exe

description	pid	Process	procid_target
PID 2084 wrote to memory of 4720	2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	80
PID 2084 wrote to memory of 4720	2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	80
PID 2084 wrote to memory of 4720	2084	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	80
PID 3980 wrote to memory of 2804	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	86
PID 3980 wrote to memory of 2804	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	86
PID 3980 wrote to memory of 2804	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	86
PID 3980 wrote to memory of 3600	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	88
PID 3980 wrote to memory of 3600	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	88
PID 3600 wrote to memory of 1796	3600	cmd.exe	90
PID 3600 wrote to memory of 1796	3600	cmd.exe	90
PID 3980 wrote to memory of 3452	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	91
PID 3980 wrote to memory of 3452	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	91
PID 3980 wrote to memory of 3452	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	91
PID 3980 wrote to memory of 2232	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	93
PID 3980 wrote to memory of 2232	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	93
PID 3980 wrote to memory of 2232	3980	73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe	93

C:\Users\Admin\AppData\Local\Temp\73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
"C:\Users\Admin\AppData\Local\Temp\73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe
  "C:\Users\Admin\AppData\Local\Temp\73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:4304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2508
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1664
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4084
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:1432
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3944
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:4928
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:3244
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:2412

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0iyvi3xa.23l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3f4da4f7940fc049b168ce335f281ebe

SHA1
1abf97ff704bbb24c5c62a36a8b15d012868f50a

SHA256
91ef9f490559b1d672f6fcc48f69316f25c1b74d44031b8f1f51c47706624731

SHA512
bd42876fa777db69460cedbcf1163d07bcec6c7aab42807c12eb6548194b69dd33c61179ef1f8c09be4fd139706f4e2db8ce4d8153a25f0e31d4906e3cae8278

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
8d28d56d93da0adac0ed262d5b522417

SHA1
45a5e434140dc2a09deb5f4c1e6f4103efa0779d

SHA256
75e13621d97dda4b21411563d903f2bb259ce78c9503098a6b7557e099fca122

SHA512
78cd2a7aca44d95c3422a80d896fb012e6b3771b2b5de0caaf7462b209c2f957a81d7eeffc86cb7e5e64b9c725f11ccb5ccce8007fcb2f0bd27a862fa1a9703f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
8113cff9b31ace9d09d80814f80cc87f

SHA1
1bb7e74e59a96b98429a4e27fdd449772c972abb

SHA256
7d368cd82a3c4d5c6044a1678415be1b63ed679d7e73a054684b050649059a62

SHA512
454127df3fd7bbc06c7bb1680aefa7b442f9e769697ffe3c9c2d6ecfdf0a1705ce70f3e4590ac3feed25b3143f28ff080038f1d8718fe1312a356a5b8f414ac2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
32d59286957440b5ea21334cf3c853b6

SHA1
3710e5db6ff6b41891cc42342270b6836c855000

SHA256
3e21abf4de89e4a3e723cc0d3819daff7a7f8784d9ae4398871eb3161f76f78a

SHA512
95ac71ae1a981ee9b448dd4b3fa852b511118b31948bd287b0e81d4ccf12f6339a6e1b51cbb44851abbf99a4162b329426ca602e779bfc01be4b66505f6c0f0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
da024a81661735f99cfa4f6997c07da1

SHA1
fdc3b6bcf20eddf437465e5bc0a764fde5559f79

SHA256
4e4b537e8467bf741d85a2c103375a241c5818e883a1b1e091ea67dbfe8e12b6

SHA512
df74f4b6415039e3073534f0f964f9e189bfedd56c11ce0b894bd3bb1988dc800960733a1cc2283bae6841a52bd2d34f10f41aaddde37a255abe40bba46d70e3

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
fee04bb4f2890f2e90b4b12de4b729c8

SHA1
2fcf87cec6fa8ce956b0442eab3a1335f48ce3f2

SHA256
73bd536c26539ef63cdc61dc5c6f261f7f9767c54fcfdd6a6c3c616ce4420080

SHA512
00ca03e958789e5c41060d7dec99cdc88e00c88dcd2653f2e0370bb42066c1f687cc304391ca9f891c445d858000675eda402985057314bbbf20a184c2abfb36

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1516-182-0x00000000060C0000-0x0000000006417000-memory.dmp

Filesize
3.3MB

Download
memory/1516-185-0x0000000070400000-0x0000000070757000-memory.dmp

Filesize
3.3MB

Download
memory/1516-184-0x0000000070260000-0x00000000702AC000-memory.dmp

Filesize
304KB

Download
memory/2084-195-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2084-127-0x0000000004A10000-0x00000000052FB000-memory.dmp

Filesize
8.9MB

Download
memory/2084-126-0x0000000004610000-0x0000000004A0F000-memory.dmp

Filesize
4.0MB

Download
memory/2084-125-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/2084-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2084-1-0x0000000004610000-0x0000000004A0F000-memory.dmp

Filesize
4.0MB

Download
memory/2084-2-0x0000000004A10000-0x00000000052FB000-memory.dmp

Filesize
8.9MB

Download
memory/2232-106-0x0000000006130000-0x0000000006487000-memory.dmp

Filesize
3.3MB

Download
memory/2232-109-0x00000000704E0000-0x0000000070837000-memory.dmp

Filesize
3.3MB

Download
memory/2232-108-0x0000000070340000-0x000000007038C000-memory.dmp

Filesize
304KB

Download
memory/2508-138-0x0000000070340000-0x000000007038C000-memory.dmp

Filesize
304KB

Download
memory/2508-139-0x00000000705B0000-0x0000000070907000-memory.dmp

Filesize
3.3MB

Download
memory/2508-130-0x00000000062C0000-0x0000000006617000-memory.dmp

Filesize
3.3MB

Download
memory/2724-228-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2724-219-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2724-213-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2724-209-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2804-73-0x00000000074D0000-0x00000000074E5000-memory.dmp

Filesize
84KB

Download
memory/2804-61-0x0000000070340000-0x000000007038C000-memory.dmp

Filesize
304KB

Download
memory/2804-72-0x0000000007480000-0x0000000007491000-memory.dmp

Filesize
68KB

Download
memory/2804-60-0x0000000005A20000-0x0000000005D77000-memory.dmp

Filesize
3.3MB

Download
memory/2804-62-0x00000000704C0000-0x0000000070817000-memory.dmp

Filesize
3.3MB

Download
memory/2804-71-0x0000000007150000-0x00000000071F4000-memory.dmp

Filesize
656KB

Download
memory/3452-87-0x0000000070340000-0x000000007038C000-memory.dmp

Filesize
304KB

Download
memory/3452-85-0x00000000063B0000-0x0000000006707000-memory.dmp

Filesize
3.3MB

Download
memory/3452-88-0x0000000070C80000-0x0000000070FD7000-memory.dmp

Filesize
3.3MB

Download
memory/3980-123-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4084-159-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Filesize
304KB

Download
memory/4084-157-0x0000000005640000-0x0000000005997000-memory.dmp

Filesize
3.3MB

Download
memory/4084-170-0x0000000006E60000-0x0000000006F04000-memory.dmp

Filesize
656KB

Download
memory/4084-161-0x0000000070BA0000-0x0000000070EF7000-memory.dmp

Filesize
3.3MB

Download
memory/4084-171-0x00000000071B0000-0x00000000071C1000-memory.dmp

Filesize
68KB

Download
memory/4084-160-0x0000000070260000-0x00000000702AC000-memory.dmp

Filesize
304KB

Download
memory/4084-172-0x00000000059F0000-0x0000000005A05000-memory.dmp

Filesize
84KB

Download
memory/4304-230-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-221-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-224-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-218-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-215-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-212-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-202-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-227-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-233-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-236-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-239-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-242-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4304-245-0x0000000000400000-0x0000000002733000-memory.dmp

Filesize
35.2MB

Download
memory/4720-46-0x00000000079C0000-0x00000000079DA000-memory.dmp

Filesize
104KB

Download
memory/4720-41-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/4720-42-0x0000000007A00000-0x0000000007A96000-memory.dmp

Filesize
600KB

Download
memory/4720-43-0x0000000007910000-0x0000000007921000-memory.dmp

Filesize
68KB

Download
memory/4720-20-0x0000000005E10000-0x0000000006167000-memory.dmp

Filesize
3.3MB

Download
memory/4720-10-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/4720-9-0x0000000005460000-0x0000000005482000-memory.dmp

Filesize
136KB

Download
memory/4720-8-0x00000000740D0000-0x0000000074881000-memory.dmp

Filesize
7.7MB

Download
memory/4720-7-0x0000000005590000-0x0000000005BBA000-memory.dmp

Filesize
6.2MB

Download
memory/4720-6-0x00000000740D0000-0x0000000074881000-memory.dmp

Filesize
7.7MB

Download
memory/4720-5-0x0000000002E30000-0x0000000002E66000-memory.dmp

Filesize
216KB

Download
memory/4720-21-0x0000000006320000-0x000000000633E000-memory.dmp

Filesize
120KB

Download
memory/4720-4-0x00000000740DE000-0x00000000740DF000-memory.dmp

Filesize
4KB

Download
memory/4720-50-0x00000000740D0000-0x0000000074881000-memory.dmp

Filesize
7.7MB

Download
memory/4720-25-0x0000000070340000-0x000000007038C000-memory.dmp

Filesize
304KB

Download
memory/4720-11-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/4720-44-0x0000000007960000-0x000000000796E000-memory.dmp

Filesize
56KB

Download
memory/4720-24-0x0000000007730000-0x0000000007764000-memory.dmp

Filesize
208KB

Download
memory/4720-22-0x0000000006340000-0x000000000638C000-memory.dmp

Filesize
304KB

Download
memory/4720-23-0x00000000072B0000-0x00000000072F6000-memory.dmp

Filesize
280KB

Download
memory/4720-40-0x00000000078B0000-0x00000000078CA000-memory.dmp

Filesize
104KB

Download
memory/4720-26-0x0000000070510000-0x0000000070867000-memory.dmp

Filesize
3.3MB

Download
memory/4720-45-0x0000000007970000-0x0000000007985000-memory.dmp

Filesize
84KB

Download
memory/4720-47-0x00000000079E0000-0x00000000079E8000-memory.dmp

Filesize
32KB

Download
memory/4720-39-0x0000000007EF0000-0x000000000856A000-memory.dmp

Filesize
6.5MB

Download
memory/4720-37-0x0000000007790000-0x0000000007834000-memory.dmp

Filesize
656KB

Download
memory/4720-36-0x0000000007770000-0x000000000778E000-memory.dmp

Filesize
120KB

Download
memory/4720-27-0x00000000740D0000-0x0000000074881000-memory.dmp

Filesize
7.7MB

Download
memory/4720-38-0x00000000740D0000-0x0000000074881000-memory.dmp

Filesize
7.7MB

Download
memory/4928-210-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4928-207-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download