glupteba | 06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8

Analysis

max time kernel
206s
max time network
219s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Size

4.2MB
MD5

e6e05386bae59df6d3a45a05fccee8b4
SHA1

c088edb925bf6f0b6f9c903687e4bd02ba65e6d7
SHA256

06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8
SHA512

a8f215119532303d08177e606ec5d4825d2bb785fb38da89b93ae7ea3b1723be265363a46348ff6a1f3a10bdfb345b2cfa354acb6f01d5debbc121f80f3cec26
SSDEEP

98304:MRUBmLZ3rmtSop/fcfKtwQG3TQtt4oKMJO6VS6U7CKzh7s:UxKEC/fcfKt9ykOWRUGoh7s

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3000-2-0x0000000005360000-0x0000000005C4B000-memory.dmp	family_glupteba
behavioral2/memory/3000-3-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3000-4-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3000-24-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3000-27-0x0000000005360000-0x0000000005C4B000-memory.dmp	family_glupteba
behavioral2/memory/3000-44-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3000-57-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-60-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3000-73-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-89-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-96-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-126-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-156-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/2052-160-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3044-191-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3044-249-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3044-257-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba
behavioral2/memory/3044-266-0x0000000000400000-0x000000000310F000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

992 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exe

pid process

3044 csrss.exe
5112 injector.exe
2264 windefender.exe
3308 windefender.exe

pid	process
992	netsh.exe

pid	process
3044	csrss.exe
5112	injector.exe
2264	windefender.exe
3308	windefender.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/2264-265-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-825860316-2493133627-3905166409-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-825860316-2493133627-3905166409-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

description	ioc	process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
File created	C:\Windows\rss\csrss.exe	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4688 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4640 3000 WerFault.exe 06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3400 schtasks.exe
3968 schtasks.exe

pid	process
4688	sc.exe

pid	pid_target	process	target process
4640	3000	WerFault.exe	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

pid	process
3400	schtasks.exe
3968	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exepowershell.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
848	powershell.exe
848	powershell.exe
3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
1540	powershell.exe
1540	powershell.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
1944	powershell.exe
1944	powershell.exe
3576	powershell.exe
3576	powershell.exe
1924	powershell.exe
1924	powershell.exe
5028	powershell.exe
5028	powershell.exe
3756	powershell.exe
3756	powershell.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
3044	csrss.exe
3044	csrss.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
3044	csrss.exe
3044	csrss.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
3044	csrss.exe
3044	csrss.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe
5112	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Token: SeImpersonatePrivilege	3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeSystemEnvironmentPrivilege	3044	csrss.exe
Token: SeSecurityPrivilege	4688	sc.exe
Token: SeSecurityPrivilege	4688	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 3000 wrote to memory of 848	3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 3000 wrote to memory of 848	3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 3000 wrote to memory of 848	3000	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1540	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1540	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1540	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1448	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	cmd.exe
PID 2052 wrote to memory of 1448	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	cmd.exe
PID 1448 wrote to memory of 992	1448	cmd.exe	netsh.exe
PID 1448 wrote to memory of 992	1448	cmd.exe	netsh.exe
PID 2052 wrote to memory of 1944	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1944	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 1944	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 3576	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 3576	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 3576	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	powershell.exe
PID 2052 wrote to memory of 3044	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	csrss.exe
PID 2052 wrote to memory of 3044	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	csrss.exe
PID 2052 wrote to memory of 3044	2052	06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe	csrss.exe
PID 3044 wrote to memory of 1924	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 1924	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 1924	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 5028	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 5028	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 5028	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 3756	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 3756	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 3756	3044	csrss.exe	powershell.exe
PID 3044 wrote to memory of 5112	3044	csrss.exe	injector.exe
PID 3044 wrote to memory of 5112	3044	csrss.exe	injector.exe
PID 2264 wrote to memory of 764	2264	windefender.exe	cmd.exe
PID 2264 wrote to memory of 764	2264	windefender.exe	cmd.exe
PID 2264 wrote to memory of 764	2264	windefender.exe	cmd.exe
PID 764 wrote to memory of 4688	764	cmd.exe	sc.exe
PID 764 wrote to memory of 4688	764	cmd.exe	sc.exe
PID 764 wrote to memory of 4688	764	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
"C:\Users\Admin\AppData\Local\Temp\06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Users\Admin\AppData\Local\Temp\06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe
"C:\Users\Admin\AppData\Local\Temp\06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8.exe"
2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3400

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:1664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5112

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:3968

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 784
2⤵
- Program crash
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3000 -ip 3000
1⤵
PID:500

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:3308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_chrao4gv.c32.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
f5a8e5451de5e23ee8712d0b200484fb

SHA1
cbad55bf43a7b784ef270fdacce5ca276175eb77

SHA256
8befeeeaf4e80ddfd77d42953926da2cecfc7b13b9a0a19ec2f00f869f6a0a1c

SHA512
a8dc4b00f3886ca12f55e96ff6d333ad2c4c0ff65dd2c4d29d491858c5f7b62e540867d72095ad4c8109210026cc3c210a1cd58b34b732a70399e9b750020335

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
c66492714ed8dbf93482d9cb51887326

SHA1
bc978b4d3e25106f08f1adb29da5da329289749b

SHA256
b5ad1f0896bc051ba18b412469563c924e21170b31ab3c10532809c8ceacce33

SHA512
426f4e885f9a84d770e72b25b052fe61ba999d25ccdc8b7c22515e81e4164cce71f3c1cc4ab3414a75a4211bc8306e5120cd7577609cf24856e7eb39abfe63fb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
c829182df6865b1f28f14e16f04fcfd9

SHA1
62d102a7cf2765ed094efd0f664cd057ee0637f2

SHA256
0d961498c0c3fa12970110cb0aa871901c4d288580ff8c45ff796abca9a939eb

SHA512
969dc838194a5e82f4b65bd63acf290e82be5b48fd84daf94f9f2fc6c1c06a21fe4a4156f2413469fef9bbbcfd5f6a228fb44ef246d4b274d8f4e726bb7e4cd9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5597240f4d36813e12384369ea4cdc33

SHA1
af9da88d808b94adff729b82b6c6b759406b5357

SHA256
326d6741afef8a598e2abeebaa79fc13166875c5f3770c48d84a2fd6b14210df

SHA512
9001708967016ee1bdd5d53d52241fb72d32d8582ca7b4c26f429b36d0b73343c52d13c9089ce378453ede51f8b2998a9f8c71aa96ea24f3f7732215af99346c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
abd83dccca2051cd09040bca1a24cf1a

SHA1
e8f42b1cacde10d104ecc1185006f171399a917c

SHA256
8505bcac77baa889f368e1e87362edda423ac8d94affdd9c58b8cb0999ea7ae6

SHA512
acce1667733e9eac0cce1467f07a3c20ce140faf846e645795802d1be20fa907c7582ceb0293b92fbf9aa1a93e7446f5af1b8c636d619bf44d2b06fd50a7cea7

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
e6e05386bae59df6d3a45a05fccee8b4

SHA1
c088edb925bf6f0b6f9c903687e4bd02ba65e6d7

SHA256
06fcd67bc1083ded90f78f9267832a7e377528ec21c9ddb4ced842011729a5f8

SHA512
a8f215119532303d08177e606ec5d4825d2bb785fb38da89b93ae7ea3b1723be265363a46348ff6a1f3a10bdfb345b2cfa354acb6f01d5debbc121f80f3cec26

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/848-21-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/848-41-0x00000000078E0000-0x0000000007984000-memory.dmp

Filesize
656KB

Download
memory/848-22-0x00000000064D0000-0x000000000651C000-memory.dmp

Filesize
304KB

Download
memory/848-12-0x0000000005F60000-0x00000000062B7000-memory.dmp

Filesize
3.3MB

Download
memory/848-11-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/848-10-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/848-9-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/848-25-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/848-8-0x00000000057E0000-0x0000000005E0A000-memory.dmp

Filesize
6.2MB

Download
memory/848-7-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/848-28-0x000000007F850000-0x000000007F860000-memory.dmp

Filesize
64KB

Download
memory/848-29-0x00000000078A0000-0x00000000078D4000-memory.dmp

Filesize
208KB

Download
memory/848-30-0x0000000070240000-0x000000007028C000-memory.dmp

Filesize
304KB

Download
memory/848-31-0x00000000704B0000-0x0000000070807000-memory.dmp

Filesize
3.3MB

Download
memory/848-40-0x0000000007880000-0x000000000789E000-memory.dmp

Filesize
120KB

Download
memory/848-23-0x0000000007510000-0x0000000007556000-memory.dmp

Filesize
280KB

Download
memory/848-42-0x00000000080F0000-0x000000000876A000-memory.dmp

Filesize
6.5MB

Download
memory/848-43-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Filesize
104KB

Download
memory/848-45-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

Filesize
40KB

Download
memory/848-6-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/848-46-0x0000000007C00000-0x0000000007C96000-memory.dmp

Filesize
600KB

Download
memory/848-47-0x0000000007B10000-0x0000000007B21000-memory.dmp

Filesize
68KB

Download
memory/848-48-0x0000000007B80000-0x0000000007B8E000-memory.dmp

Filesize
56KB

Download
memory/848-49-0x0000000007B90000-0x0000000007BA5000-memory.dmp

Filesize
84KB

Download
memory/848-50-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

Filesize
104KB

Download
memory/848-52-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/848-53-0x0000000007A20000-0x0000000007A28000-memory.dmp

Filesize
32KB

Download
memory/848-56-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/848-5-0x0000000005040000-0x0000000005076000-memory.dmp

Filesize
216KB

Download
memory/1540-72-0x0000000006310000-0x0000000006667000-memory.dmp

Filesize
3.3MB

Download
memory/1540-88-0x0000000007CF0000-0x0000000007D01000-memory.dmp

Filesize
68KB

Download
memory/1540-61-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/1540-62-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/1540-63-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/1540-94-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/1540-74-0x0000000006920000-0x000000000696C000-memory.dmp

Filesize
304KB

Download
memory/1540-91-0x0000000007D40000-0x0000000007D55000-memory.dmp

Filesize
84KB

Download
memory/1540-75-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/1540-76-0x000000007FA00000-0x000000007FA10000-memory.dmp

Filesize
64KB

Download
memory/1540-77-0x0000000070370000-0x00000000703BC000-memory.dmp

Filesize
304KB

Download
memory/1540-78-0x00000000703C0000-0x0000000070717000-memory.dmp

Filesize
3.3MB

Download
memory/1540-87-0x00000000079F0000-0x0000000007A94000-memory.dmp

Filesize
656KB

Download
memory/1944-111-0x0000000002E50000-0x0000000002E60000-memory.dmp

Filesize
64KB

Download
memory/1944-123-0x0000000007440000-0x00000000074E4000-memory.dmp

Filesize
656KB

Download
memory/1944-128-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/1944-125-0x0000000005BA0000-0x0000000005BB5000-memory.dmp

Filesize
84KB

Download
memory/1944-124-0x00000000077A0000-0x00000000077B1000-memory.dmp

Filesize
68KB

Download
memory/1944-114-0x0000000070570000-0x00000000708C7000-memory.dmp

Filesize
3.3MB

Download
memory/1944-113-0x0000000070350000-0x000000007039C000-memory.dmp

Filesize
304KB

Download
memory/1944-98-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download
memory/1944-99-0x0000000002E50000-0x0000000002E60000-memory.dmp

Filesize
64KB

Download
memory/1944-105-0x0000000005C40000-0x0000000005F97000-memory.dmp

Filesize
3.3MB

Download
memory/1944-112-0x000000007F6A0000-0x000000007F6B0000-memory.dmp

Filesize
64KB

Download
memory/1944-110-0x0000000006300000-0x000000000634C000-memory.dmp

Filesize
304KB

Download
memory/2052-60-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2052-89-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2052-160-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2052-96-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2052-156-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2052-95-0x0000000004E30000-0x000000000522C000-memory.dmp

Filesize
4.0MB

Download
memory/2052-59-0x0000000004E30000-0x000000000522C000-memory.dmp

Filesize
4.0MB

Download
memory/2052-126-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/2264-265-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-44-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3000-2-0x0000000005360000-0x0000000005C4B000-memory.dmp

Filesize
8.9MB

Download
memory/3000-27-0x0000000005360000-0x0000000005C4B000-memory.dmp

Filesize
8.9MB

Download
memory/3000-73-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3000-26-0x0000000004F50000-0x0000000005354000-memory.dmp

Filesize
4.0MB

Download
memory/3000-57-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3000-24-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3000-1-0x0000000004F50000-0x0000000005354000-memory.dmp

Filesize
4.0MB

Download
memory/3000-4-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3000-3-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3044-191-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3044-249-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3044-257-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3044-266-0x0000000000400000-0x000000000310F000-memory.dmp

Filesize
45.1MB

Download
memory/3576-130-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download
memory/3576-129-0x0000000073FD0000-0x0000000074781000-memory.dmp

Filesize
7.7MB

Download