Analysis
-
max time kernel
153s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
06-06-2023 22:48
Static task
static1
General
-
Target
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe
-
Size
4.2MB
-
MD5
5e9d25df150d4ab935ba9b9b49455f7c
-
SHA1
7dd213acbf75d86d051e4aefa905e5b0471c7032
-
SHA256
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d
-
SHA512
fb14a8d8c4a615b3ebe3e4bc6186ce7eae028c79d86d0d6e5daf96b588e92d17efa1260071f02e4edf894f3faec736ade82d9f52727735f20f895c692f647cc8
-
SSDEEP
98304:YpjGb0Pg7YgkXMGp2wJncYbqkxEXKJX4478CQikEd6UOl:YpjvTgAlp5Jcwr+aisdQjEQUU
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-117-0x00000000051F0000-0x0000000005ADB000-memory.dmp family_glupteba behavioral1/memory/3040-160-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/3040-411-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/3040-413-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2472-446-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2472-758-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2472-1144-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2472-1147-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1175-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1495-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1859-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1887-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1896-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1898-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1900-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1902-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2524-1904-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba -
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2524 csrss.exe 3016 injector.exe 4000 windefender.exe 3144 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4000-1892-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral1/memory/3144-1894-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4000-1895-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3144-1897-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3144-1903-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe = "0" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe -
Drops file in Windows directory 4 IoCs
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe File created C:\Windows\rss\csrss.exe 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3140 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4272 schtasks.exe 4056 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exewindefender.exe4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exepowershell.exe4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 324 powershell.exe 324 powershell.exe 324 powershell.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe 5044 powershell.exe 5044 powershell.exe 5044 powershell.exe 2468 powershell.exe 2468 powershell.exe 2468 powershell.exe 3596 powershell.exe 3596 powershell.exe 3596 powershell.exe 3424 powershell.exe 3424 powershell.exe 3424 powershell.exe 3660 powershell.exe 3660 powershell.exe 3660 powershell.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 2524 csrss.exe 2524 csrss.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 2524 csrss.exe 2524 csrss.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 2524 csrss.exe 2524 csrss.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe 3016 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Token: SeImpersonatePrivilege 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe Token: SeDebugPrivilege 324 powershell.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 3424 powershell.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeSystemEnvironmentPrivilege 2524 csrss.exe Token: SeSecurityPrivilege 3140 sc.exe Token: SeSecurityPrivilege 3140 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3040 wrote to memory of 5100 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 3040 wrote to memory of 5100 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 3040 wrote to memory of 5100 3040 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 324 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 324 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 324 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 4264 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe cmd.exe PID 2472 wrote to memory of 4264 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe cmd.exe PID 4264 wrote to memory of 4440 4264 cmd.exe netsh.exe PID 4264 wrote to memory of 4440 4264 cmd.exe netsh.exe PID 2472 wrote to memory of 5044 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 5044 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 5044 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 2468 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 2468 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 2468 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe powershell.exe PID 2472 wrote to memory of 2524 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe csrss.exe PID 2472 wrote to memory of 2524 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe csrss.exe PID 2472 wrote to memory of 2524 2472 4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe csrss.exe PID 2524 wrote to memory of 3596 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3596 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3596 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3424 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3424 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3424 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3660 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3660 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3660 2524 csrss.exe powershell.exe PID 2524 wrote to memory of 3016 2524 csrss.exe injector.exe PID 2524 wrote to memory of 3016 2524 csrss.exe injector.exe PID 4000 wrote to memory of 1412 4000 windefender.exe cmd.exe PID 4000 wrote to memory of 1412 4000 windefender.exe cmd.exe PID 4000 wrote to memory of 1412 4000 windefender.exe cmd.exe PID 1412 wrote to memory of 3140 1412 cmd.exe sc.exe PID 1412 wrote to memory of 3140 1412 cmd.exe sc.exe PID 1412 wrote to memory of 3140 1412 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe"C:\Users\Admin\AppData\Local\Temp\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe"C:\Users\Admin\AppData\Local\Temp\4e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324 -
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:4440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4272 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:700
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3016 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4056 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ao3s0zvf.qn0.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD52f6d79e8d1c706404206cb63888d1121
SHA10b86bac9611db7e933553c7725bd555921e5ee75
SHA2569d2f70dffb3969e57d4b4e1ea05e050da9ca1c167aedb5a699b3b2d5dd0c2083
SHA512a9d01c6a45502127513dcc9a2b1da6575805f00f616ed7a48e4118aa2a504c56632410a8e8b750df714bae45dd9c7eb96c7eb5ad1b79d126fae1f720f57d7a8d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5cef457b3890cd424c71e5af1d56a9da9
SHA1dda8663c7ef31a01fb9ce84a50442cff8d429cf7
SHA256310926b8b1ed07e53907f5e27f1f4a005532ba0cc14f3781b644d04d956ef0b1
SHA512ce2a02fa0d79af974d22e1550ab0468c335501ea2bfe9eb732e9d1ca51593a85186949ca089f00c2e0424e820a60ea4b2e9e2989003f7e6ed4d9aef4957c0cd9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5693728a3520c4ddc9cd55864c3f79a9d
SHA15c045860d668c300c9529e0ae4c0e28a7f38cc7b
SHA25665d22b22e959ca2a7fc7466e8d8873e5e59bd50c94bcac4f5c8f8d4e8c6495ee
SHA5120f092ad08c6cb7d6a1ce410512a34db13adebe13a8f651d6fa52291c8dba4e8e56b7dc0d5561de7f7f9fc6d0f428d633bfed349aace233941c4792f0672ff126
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD58f397cdcd7804688b23ef79832e881d4
SHA1381803309b9e8f84216b2c751fc33b69e12d06ae
SHA256fdbb368e9e45be0272098676cfc875e6652564638246ea16a3656467c03d41b8
SHA5123efe96561535fb05997bde5fed5b7d087dceaee6684a1062444ca35339ac1611cc7ae57dd996feadad4a923ac060660060c6a9d189a6374f3858a8f9fb3d4d04
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5409f4abbcd822771cc73c32a3fff2b72
SHA1364f308630d093ea520169cb874d08e2ecb934fa
SHA256695192af0602e738119733639b0b875eecb14e5515205c9bf7615dee272aecd6
SHA5124c802978818482177882d67e2920756460beabc8037192a778ff8cb927418ef099ad16311a4b99762fec30fb021e79b2c7fc41117dec63ecfcebf33abb2d2f1c
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD55e9d25df150d4ab935ba9b9b49455f7c
SHA17dd213acbf75d86d051e4aefa905e5b0471c7032
SHA2564e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d
SHA512fb14a8d8c4a615b3ebe3e4bc6186ce7eae028c79d86d0d6e5daf96b588e92d17efa1260071f02e4edf894f3faec736ade82d9f52727735f20f895c692f647cc8
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD55e9d25df150d4ab935ba9b9b49455f7c
SHA17dd213acbf75d86d051e4aefa905e5b0471c7032
SHA2564e86a17fac79bfe0857a2e2fa3734bb4af985f0afa118b43185734a8f3015a3d
SHA512fb14a8d8c4a615b3ebe3e4bc6186ce7eae028c79d86d0d6e5daf96b588e92d17efa1260071f02e4edf894f3faec736ade82d9f52727735f20f895c692f647cc8
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/324-453-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/324-443-0x0000000009660000-0x0000000009705000-memory.dmpFilesize
660KB
-
memory/324-419-0x0000000007BD0000-0x0000000007F20000-memory.dmpFilesize
3.3MB
-
memory/324-417-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/324-418-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/324-451-0x000000007E780000-0x000000007E790000-memory.dmpFilesize
64KB
-
memory/324-420-0x00000000081D0000-0x000000000821B000-memory.dmpFilesize
300KB
-
memory/2468-978-0x000000007EE60000-0x000000007EE70000-memory.dmpFilesize
64KB
-
memory/2468-905-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/2468-979-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/2472-1147-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2472-1144-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2472-446-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2472-758-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1495-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1904-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1902-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1900-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1898-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1175-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1896-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1887-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/2524-1859-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/3040-413-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/3040-411-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/3040-160-0x0000000000400000-0x00000000030D0000-memory.dmpFilesize
44.8MB
-
memory/3040-117-0x00000000051F0000-0x0000000005ADB000-memory.dmpFilesize
8.9MB
-
memory/3144-1903-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3144-1894-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3144-1897-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3424-1494-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/3424-1399-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/3424-1424-0x0000000009B70000-0x0000000009C15000-memory.dmpFilesize
660KB
-
memory/3424-1401-0x00000000089C0000-0x0000000008A0B000-memory.dmpFilesize
300KB
-
memory/3424-1397-0x0000000008140000-0x0000000008490000-memory.dmpFilesize
3.3MB
-
memory/3424-1493-0x000000007F5E0000-0x000000007F5F0000-memory.dmpFilesize
64KB
-
memory/3424-1400-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/3596-1153-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/3596-1156-0x00000000082C0000-0x000000000830B000-memory.dmpFilesize
300KB
-
memory/3596-1179-0x000000007F750000-0x000000007F760000-memory.dmpFilesize
64KB
-
memory/3596-1154-0x0000000007710000-0x0000000007A60000-memory.dmpFilesize
3.3MB
-
memory/3596-1181-0x0000000009310000-0x00000000093B5000-memory.dmpFilesize
660KB
-
memory/3596-1191-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/3596-1152-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/3660-1736-0x00000000069D0000-0x00000000069E0000-memory.dmpFilesize
64KB
-
memory/3660-1643-0x00000000069D0000-0x00000000069E0000-memory.dmpFilesize
64KB
-
memory/3660-1663-0x000000007F360000-0x000000007F370000-memory.dmpFilesize
64KB
-
memory/3660-1644-0x00000000069D0000-0x00000000069E0000-memory.dmpFilesize
64KB
-
memory/4000-1895-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4000-1892-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5044-664-0x00000000065F0000-0x0000000006600000-memory.dmpFilesize
64KB
-
memory/5044-665-0x00000000065F0000-0x0000000006600000-memory.dmpFilesize
64KB
-
memory/5044-755-0x000000007EDE0000-0x000000007EDF0000-memory.dmpFilesize
64KB
-
memory/5044-757-0x00000000065F0000-0x0000000006600000-memory.dmpFilesize
64KB
-
memory/5100-125-0x0000000006C50000-0x0000000006CB6000-memory.dmpFilesize
408KB
-
memory/5100-121-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/5100-188-0x0000000009670000-0x000000000968E000-memory.dmpFilesize
120KB
-
memory/5100-193-0x0000000009950000-0x00000000099F5000-memory.dmpFilesize
660KB
-
memory/5100-124-0x0000000006AB0000-0x0000000006AD2000-memory.dmpFilesize
136KB
-
memory/5100-123-0x0000000006E10000-0x0000000007438000-memory.dmpFilesize
6.2MB
-
memory/5100-194-0x0000000009B10000-0x0000000009BA4000-memory.dmpFilesize
592KB
-
memory/5100-122-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/5100-187-0x0000000009910000-0x0000000009943000-memory.dmpFilesize
204KB
-
memory/5100-126-0x0000000006CC0000-0x0000000006D26000-memory.dmpFilesize
408KB
-
memory/5100-120-0x0000000004160000-0x0000000004196000-memory.dmpFilesize
216KB
-
memory/5100-180-0x0000000008A60000-0x0000000008AD6000-memory.dmpFilesize
472KB
-
memory/5100-148-0x0000000007EF0000-0x0000000007F2C000-memory.dmpFilesize
240KB
-
memory/5100-129-0x0000000007970000-0x00000000079BB000-memory.dmpFilesize
300KB
-
memory/5100-128-0x00000000074F0000-0x000000000750C000-memory.dmpFilesize
112KB
-
memory/5100-127-0x0000000007620000-0x0000000007970000-memory.dmpFilesize
3.3MB
-
memory/5100-195-0x000000007EC70000-0x000000007EC80000-memory.dmpFilesize
64KB
-
memory/5100-196-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/5100-389-0x0000000009A70000-0x0000000009A8A000-memory.dmpFilesize
104KB
-
memory/5100-394-0x0000000009A40000-0x0000000009A48000-memory.dmpFilesize
32KB