Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
07-06-2023 04:53
Static task
static1
General
-
Target
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe
-
Size
4.2MB
-
MD5
ed5c87772a5712ca9aabfef82435f7b2
-
SHA1
ed5c90d94f9ee59ee52d4cf977e97b9423f23732
-
SHA256
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2
-
SHA512
1bca97953981156be76082c580f5e8b4a34d656d191bd92118670e2fae321e9090754ef0cac920c6cfde015ad182efe247dff0e2f9c64368d6983582e3ab1083
-
SSDEEP
98304:+wxLTHiVfND5jI8y46oyWY2H3chRPWTrgRgGL/Yh55yA:+wxHode46pGHKwrgacy5b
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3200-122-0x0000000004C70000-0x000000000555B000-memory.dmp family_glupteba behavioral1/memory/3200-185-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/3200-417-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/3200-419-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/220-547-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/220-765-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/220-1057-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/220-1155-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1361-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1639-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1893-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1901-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1903-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1905-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1907-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1909-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba behavioral1/memory/2612-1911-0x0000000000400000-0x0000000002958000-memory.dmp family_glupteba -
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2612 csrss.exe 4072 injector.exe 4260 windefender.exe 2560 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral1/memory/4260-1899-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2560-1900-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2560-1906-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe -
Drops file in Windows directory 4 IoCs
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1808 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exepowershell.exe6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4540 powershell.exe 4540 powershell.exe 4540 powershell.exe 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 2152 powershell.exe 2152 powershell.exe 2152 powershell.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe 4920 powershell.exe 4920 powershell.exe 4920 powershell.exe 3760 powershell.exe 3760 powershell.exe 3760 powershell.exe 2440 powershell.exe 2440 powershell.exe 2440 powershell.exe 3984 powershell.exe 3984 powershell.exe 3984 powershell.exe 4784 powershell.exe 4784 powershell.exe 4784 powershell.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 2612 csrss.exe 2612 csrss.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 2612 csrss.exe 2612 csrss.exe 4072 injector.exe 4072 injector.exe 2612 csrss.exe 2612 csrss.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe 4072 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4540 powershell.exe Token: SeDebugPrivilege 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Token: SeImpersonatePrivilege 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 4920 powershell.exe Token: SeDebugPrivilege 3760 powershell.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: SeDebugPrivilege 4784 powershell.exe Token: SeSystemEnvironmentPrivilege 2612 csrss.exe Token: SeSecurityPrivilege 1808 sc.exe Token: SeSecurityPrivilege 1808 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3200 wrote to memory of 4540 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 3200 wrote to memory of 4540 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 3200 wrote to memory of 4540 3200 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 2152 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 2152 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 2152 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 5056 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe cmd.exe PID 220 wrote to memory of 5056 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe cmd.exe PID 5056 wrote to memory of 5028 5056 cmd.exe netsh.exe PID 5056 wrote to memory of 5028 5056 cmd.exe netsh.exe PID 220 wrote to memory of 4920 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 4920 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 4920 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 3760 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 3760 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 3760 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe powershell.exe PID 220 wrote to memory of 2612 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe csrss.exe PID 220 wrote to memory of 2612 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe csrss.exe PID 220 wrote to memory of 2612 220 6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe csrss.exe PID 2612 wrote to memory of 2440 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 2440 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 2440 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 3984 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 3984 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 3984 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 4784 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 4784 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 4784 2612 csrss.exe powershell.exe PID 2612 wrote to memory of 4072 2612 csrss.exe injector.exe PID 2612 wrote to memory of 4072 2612 csrss.exe injector.exe PID 4260 wrote to memory of 4164 4260 windefender.exe cmd.exe PID 4260 wrote to memory of 4164 4260 windefender.exe cmd.exe PID 4260 wrote to memory of 4164 4260 windefender.exe cmd.exe PID 4164 wrote to memory of 1808 4164 cmd.exe sc.exe PID 4164 wrote to memory of 1808 4164 cmd.exe sc.exe PID 4164 wrote to memory of 1808 4164 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe"C:\Users\Admin\AppData\Local\Temp\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe"C:\Users\Admin\AppData\Local\Temp\6c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5y4yhjx1.mig.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD57b7739b47d174128508d9eb8f7ff3ec5
SHA110be9bb43aefa977613a10f330adcb61ebac3cd8
SHA25672a961827edb6a616dbe3fc19ad7d9e072792c621091d6f31ca58affaa0de5ef
SHA512bd7a3db0ce06cffc1568632cee902f0552c929d10d6f69c133d837dda9edc2ac52cc54e113b9ca0a5698ed578b00b08309da886e99323057738ba1204ed7a6be
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5abbc12fe34476da6a850fd4880634d91
SHA1eed32d8e358fe1a73ae15f2ad5f4ea463d0a0b0b
SHA25698ce05aef58aef419a6055bff0818fca36b80831b85bac6f855948f99c6c1c48
SHA512bd0455719eb89c2f264774f07cff26636052a9c43b1956a9585264c7987f94a78866d35a91cdbc731b80c38ccf27956b08197c10e8091019a1c69d3b8e2e0edf
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5125062189b808c8c46b359d23ada2269
SHA13d5f8c1b14b226a1740792463145de773257e5dc
SHA25678b6be960b09cc544aa2feb96ba04edb6177949a06b0e97502f6f7eabeba890f
SHA512fa5165b4af712c10200df6237451e7d2da74212c3ae737ce55b29d9ba3ea39a8ae24b0832cbe619185e0ec616bbdeb3b7b1b1656f5fcdd35809852dee286a4d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD57171bf2b2559335312f0d937828a5894
SHA16b684bb6e738324c2db6cd6aa423c8dd7cdc253f
SHA25661f4665a8659ea6542fa2c523471b381fba129e412421ab5ca81f8304bda76f3
SHA51202ed988dfae64577a14b43ce481358781c2947bbf56989b1a4a052321625f3dd9d6bb8115023f0d662768f02958bf50db525a1f5b3d631a93fe34b924f48be45
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5d2b101d7fcce5512da6b4d7e1549e6bd
SHA1266d49d80a2d08e894c9f942115f615aaa86256a
SHA256460dfc4bcaa3b345010f92f007129b432e65fed6931608aab44128060ff78d18
SHA512505298a92194ea70e26316094650d26e137cb03a993c003fa460d7994dd267fcc49746af7896eb35d9185b845a878b7e45bb4bef288a723d697b3bfa11c89cfe
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5ed5c87772a5712ca9aabfef82435f7b2
SHA1ed5c90d94f9ee59ee52d4cf977e97b9423f23732
SHA2566c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2
SHA5121bca97953981156be76082c580f5e8b4a34d656d191bd92118670e2fae321e9090754ef0cac920c6cfde015ad182efe247dff0e2f9c64368d6983582e3ab1083
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5ed5c87772a5712ca9aabfef82435f7b2
SHA1ed5c90d94f9ee59ee52d4cf977e97b9423f23732
SHA2566c802135a37db67e60a254382f3a3075ec54025ffdda8c09b5da555f9d4a83d2
SHA5121bca97953981156be76082c580f5e8b4a34d656d191bd92118670e2fae321e9090754ef0cac920c6cfde015ad182efe247dff0e2f9c64368d6983582e3ab1083
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/220-765-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/220-1057-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/220-547-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/220-1155-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2152-658-0x0000000006D00000-0x0000000006D10000-memory.dmpFilesize
64KB
-
memory/2152-423-0x0000000007D70000-0x00000000080C0000-memory.dmpFilesize
3.3MB
-
memory/2152-450-0x0000000006D00000-0x0000000006D10000-memory.dmpFilesize
64KB
-
memory/2152-449-0x000000007EEA0000-0x000000007EEB0000-memory.dmpFilesize
64KB
-
memory/2152-448-0x0000000009670000-0x0000000009715000-memory.dmpFilesize
660KB
-
memory/2152-425-0x0000000006D00000-0x0000000006D10000-memory.dmpFilesize
64KB
-
memory/2152-424-0x00000000084F0000-0x000000000853B000-memory.dmpFilesize
300KB
-
memory/2440-1187-0x0000000008EA0000-0x0000000008F45000-memory.dmpFilesize
660KB
-
memory/2440-1160-0x0000000007420000-0x0000000007770000-memory.dmpFilesize
3.3MB
-
memory/2440-1188-0x000000007F0D0000-0x000000007F0E0000-memory.dmpFilesize
64KB
-
memory/2440-1243-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/2440-1163-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/2440-1162-0x00000000067B0000-0x00000000067C0000-memory.dmpFilesize
64KB
-
memory/2440-1164-0x00000000079B0000-0x00000000079FB000-memory.dmpFilesize
300KB
-
memory/2560-1906-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2560-1900-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2612-1639-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1893-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1911-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1909-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1907-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1361-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1901-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1903-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/2612-1905-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/3200-417-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/3200-122-0x0000000004C70000-0x000000000555B000-memory.dmpFilesize
8.9MB
-
memory/3200-419-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/3200-185-0x0000000000400000-0x0000000002958000-memory.dmpFilesize
37.3MB
-
memory/3760-914-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3760-937-0x000000007F470000-0x000000007F480000-memory.dmpFilesize
64KB
-
memory/3760-1006-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3760-913-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3984-1440-0x000000007EA80000-0x000000007EA90000-memory.dmpFilesize
64KB
-
memory/3984-1405-0x0000000007630000-0x0000000007980000-memory.dmpFilesize
3.3MB
-
memory/3984-1442-0x0000000006770000-0x0000000006780000-memory.dmpFilesize
64KB
-
memory/3984-1432-0x0000000009040000-0x00000000090E5000-memory.dmpFilesize
660KB
-
memory/3984-1409-0x0000000006770000-0x0000000006780000-memory.dmpFilesize
64KB
-
memory/3984-1408-0x0000000006770000-0x0000000006780000-memory.dmpFilesize
64KB
-
memory/3984-1407-0x0000000007DB0000-0x0000000007DFB000-memory.dmpFilesize
300KB
-
memory/4260-1899-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4540-223-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4540-131-0x0000000008290000-0x00000000082F6000-memory.dmpFilesize
408KB
-
memory/4540-125-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4540-395-0x000000000A360000-0x000000000A37A000-memory.dmpFilesize
104KB
-
memory/4540-400-0x000000000A350000-0x000000000A358000-memory.dmpFilesize
32KB
-
memory/4540-126-0x0000000007220000-0x0000000007256000-memory.dmpFilesize
216KB
-
memory/4540-127-0x00000000078C0000-0x0000000007EE8000-memory.dmpFilesize
6.2MB
-
memory/4540-200-0x000000000A830000-0x000000000A8C4000-memory.dmpFilesize
592KB
-
memory/4540-128-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4540-199-0x000000000A670000-0x000000000A715000-memory.dmpFilesize
660KB
-
memory/4540-129-0x0000000007F30000-0x0000000007F52000-memory.dmpFilesize
136KB
-
memory/4540-194-0x00000000086F0000-0x000000000870E000-memory.dmpFilesize
120KB
-
memory/4540-130-0x00000000080B0000-0x0000000008116000-memory.dmpFilesize
408KB
-
memory/4540-272-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/4540-193-0x000000007FC50000-0x000000007FC60000-memory.dmpFilesize
64KB
-
memory/4540-192-0x000000000A630000-0x000000000A663000-memory.dmpFilesize
204KB
-
memory/4540-184-0x0000000009820000-0x0000000009896000-memory.dmpFilesize
472KB
-
memory/4540-153-0x0000000009720000-0x000000000975C000-memory.dmpFilesize
240KB
-
memory/4540-134-0x0000000008BC0000-0x0000000008C0B000-memory.dmpFilesize
300KB
-
memory/4540-133-0x0000000007530000-0x000000000754C000-memory.dmpFilesize
112KB
-
memory/4540-132-0x0000000008300000-0x0000000008650000-memory.dmpFilesize
3.3MB
-
memory/4784-1692-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4784-1689-0x000000007F370000-0x000000007F380000-memory.dmpFilesize
64KB
-
memory/4784-1650-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4920-695-0x000000007F3F0000-0x000000007F400000-memory.dmpFilesize
64KB
-
memory/4920-672-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/4920-671-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/4920-669-0x0000000007FA0000-0x00000000082F0000-memory.dmpFilesize
3.3MB
-
memory/4920-696-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB