Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-04-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe
Resource
win10v2004-20240412-en
General
-
Target
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe
-
Size
4.2MB
-
MD5
3fc9b67c15e8703daf2f9950fbf864c2
-
SHA1
a527a1398263b904282607820c80901e9794d7c0
-
SHA256
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947
-
SHA512
0aac845a7bd41a90081d3d9656860a7d420396c84aba019ad83f4b6d1713956b21bff8d7b912d6ba5209e0fd580f9308a0b26ab0aadb9b0941ce424e478335e9
-
SSDEEP
98304:KeU9Bh0ZpWG7460rhxj0FMVy+9LgCbGoD1OyJCOsGUxDW88A2xBQ0e:K9j0jWE+llaMVy+90CpOuCOqDWtA2xB6
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/1628-2-0x0000000005280000-0x0000000005B6B000-memory.dmp family_glupteba behavioral2/memory/1628-3-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/1628-51-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/1628-53-0x0000000005280000-0x0000000005B6B000-memory.dmp family_glupteba behavioral2/memory/2384-55-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2384-102-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2384-113-0x0000000003390000-0x0000000003795000-memory.dmp family_glupteba behavioral2/memory/2384-146-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-184-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-246-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-255-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-257-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-259-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-261-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-263-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-265-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-267-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/3436-269-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1704 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3436 csrss.exe 4248 injector.exe 1976 windefender.exe 2752 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/1976-254-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2752-256-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2752-260-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe -
Drops file in Windows directory 4 IoCs
Processes:
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe File created C:\Windows\rss\csrss.exe 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2896 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1044 1628 WerFault.exe 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3396 schtasks.exe 3608 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exepowershell.exe6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3812 powershell.exe 3812 powershell.exe 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 3212 powershell.exe 3212 powershell.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe 2484 powershell.exe 2484 powershell.exe 896 powershell.exe 896 powershell.exe 3824 powershell.exe 3824 powershell.exe 4812 powershell.exe 4812 powershell.exe 5028 powershell.exe 5028 powershell.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 3436 csrss.exe 3436 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 3436 csrss.exe 3436 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 3436 csrss.exe 3436 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3812 powershell.exe Token: SeDebugPrivilege 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Token: SeImpersonatePrivilege 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe Token: SeDebugPrivilege 3212 powershell.exe Token: SeDebugPrivilege 2484 powershell.exe Token: SeDebugPrivilege 896 powershell.exe Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeSystemEnvironmentPrivilege 3436 csrss.exe Token: SeSecurityPrivilege 2896 sc.exe Token: SeSecurityPrivilege 2896 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 1628 wrote to memory of 3812 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 1628 wrote to memory of 3812 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 1628 wrote to memory of 3812 1628 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 3212 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 3212 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 3212 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 760 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe cmd.exe PID 2384 wrote to memory of 760 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe cmd.exe PID 760 wrote to memory of 1704 760 cmd.exe netsh.exe PID 760 wrote to memory of 1704 760 cmd.exe netsh.exe PID 2384 wrote to memory of 2484 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 2484 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 2484 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 896 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 896 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 896 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe powershell.exe PID 2384 wrote to memory of 3436 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe csrss.exe PID 2384 wrote to memory of 3436 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe csrss.exe PID 2384 wrote to memory of 3436 2384 6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe csrss.exe PID 3436 wrote to memory of 3824 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 3824 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 3824 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 4812 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 4812 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 4812 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 5028 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 5028 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 5028 3436 csrss.exe powershell.exe PID 3436 wrote to memory of 4248 3436 csrss.exe injector.exe PID 3436 wrote to memory of 4248 3436 csrss.exe injector.exe PID 1976 wrote to memory of 2740 1976 windefender.exe cmd.exe PID 1976 wrote to memory of 2740 1976 windefender.exe cmd.exe PID 1976 wrote to memory of 2740 1976 windefender.exe cmd.exe PID 2740 wrote to memory of 2896 2740 cmd.exe sc.exe PID 2740 wrote to memory of 2896 2740 cmd.exe sc.exe PID 2740 wrote to memory of 2896 2740 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe"C:\Users\Admin\AppData\Local\Temp\6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe"C:\Users\Admin\AppData\Local\Temp\6ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3396 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1964
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4248 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3608 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 8122⤵
- Program crash
PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1628 -ip 16281⤵PID:2280
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2752
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dy4qjbqw.nmg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD588a9b6fc1b417c965b4f1b1c19651d4e
SHA1553e25bdc2e7b6eb4a20a4b376828183db7625fe
SHA256d99ac4c6d89d2e31c192bfc5afcafb094640ea9d6d7ab92c04b1d5013915ab6e
SHA512d322c4f9eb36bf798d7728d24d95173a34bd4b26f8718692e2ea2e30c5e6fde382fcf0487654a9d806a70e59cfb916323a3e48e584fb16f0f91eae7672c37707
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD588b6891750337d1727a058a6c3266a11
SHA1b029a9456f78a6d3ccb71b1403a7f0078f0969c4
SHA256cf1db8bb9f525013cd3db44868e9a6d03f240e11873e4a9e0f2e18b0d87dd4e9
SHA512be9a9861fdb849826225e8a10deed134cc3b227dd32c6c324e8aca383dc189b750cabc71e5cf3a4c0ff94e01fa04002b5b704871459ff5a063d30eeeaaa7e0d7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5467bcd2d538316f25c171194ea09d770
SHA15ba489ff6dadfaeddfafd565916cfca021be1913
SHA256190b74eeec67b90d21a5359b7294a85346ad3384180e2d4b24d86991c7452d2c
SHA5121116eccb237a2383b25f70485b00631587cc63678f0abb21e910b1dafd2c485992a3567847048c8bc1ddb857cfb534ba4fa9124795a82f43f16ec0e7d1bcb671
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD525153712c0d2aa2b042931f0f8d3ef1e
SHA146ea756f05be2ad5d66e3d91dd7af7b93c408e1b
SHA2563a1752dbe13a1a525ffa2b0a476fed8b4b6a35864659e02b72d922365ee6f526
SHA512417088a2d439b60d567ea670e497c2f274342c041c8ed573b71d02058df72c0fa5fad5a1ec9be8b401cb9f64a05163fe402fd0844b832942d73a7e438a315859
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5abc4d82c8f17bd8492edefc339ce5264
SHA16c490a22e283575a12fdeed8d80a51141a0ce78b
SHA256b5302d216f415928d933477ce9580e2d047605f216f8414d74dcb04dcb23725b
SHA51235af5034b3d417333d15076516ce6b5ea736f482673889ab1159ee196fa87e44ce34ff360026c4dca8d44473eaec38f9686e52a490f9358b1d74caa7e3273a02
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD53fc9b67c15e8703daf2f9950fbf864c2
SHA1a527a1398263b904282607820c80901e9794d7c0
SHA2566ef1e352d8fefb44d2b8f5bd65793f589681aaa722e0646b1b797a571463c947
SHA5120aac845a7bd41a90081d3d9656860a7d420396c84aba019ad83f4b6d1713956b21bff8d7b912d6ba5209e0fd580f9308a0b26ab0aadb9b0941ce424e478335e9
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/896-129-0x000000007FB70000-0x000000007FB80000-memory.dmpFilesize
64KB
-
memory/896-131-0x0000000071300000-0x0000000071657000-memory.dmpFilesize
3.3MB
-
memory/896-130-0x00000000710B0000-0x00000000710FC000-memory.dmpFilesize
304KB
-
memory/896-118-0x0000000074DD0000-0x0000000075581000-memory.dmpFilesize
7.7MB
-
memory/896-119-0x00000000050A0000-0x00000000050B0000-memory.dmpFilesize
64KB
-
memory/1628-53-0x0000000005280000-0x0000000005B6B000-memory.dmpFilesize
8.9MB
-
memory/1628-51-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1628-1-0x00000000034D0000-0x00000000038D6000-memory.dmpFilesize
4.0MB
-
memory/1628-2-0x0000000005280000-0x0000000005B6B000-memory.dmpFilesize
8.9MB
-
memory/1628-3-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1976-254-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2384-113-0x0000000003390000-0x0000000003795000-memory.dmpFilesize
4.0MB
-
memory/2384-146-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2384-55-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2384-102-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2384-54-0x0000000003390000-0x0000000003795000-memory.dmpFilesize
4.0MB
-
memory/2484-92-0x0000000006080000-0x00000000063D7000-memory.dmpFilesize
3.3MB
-
memory/2484-117-0x0000000074DD0000-0x0000000075581000-memory.dmpFilesize
7.7MB
-
memory/2484-114-0x000000007F330000-0x000000007F340000-memory.dmpFilesize
64KB
-
memory/2484-91-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/2484-90-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/2484-89-0x0000000074DD0000-0x0000000075581000-memory.dmpFilesize
7.7MB
-
memory/2484-103-0x00000000710B0000-0x00000000710FC000-memory.dmpFilesize
304KB
-
memory/2484-104-0x0000000071300000-0x0000000071657000-memory.dmpFilesize
3.3MB
-
memory/2484-115-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/2752-260-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2752-256-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3212-69-0x000000007F7C0000-0x000000007F7D0000-memory.dmpFilesize
64KB
-
memory/3212-57-0x0000000002B00000-0x0000000002B10000-memory.dmpFilesize
64KB
-
memory/3212-58-0x0000000002B00000-0x0000000002B10000-memory.dmpFilesize
64KB
-
memory/3212-59-0x0000000005A80000-0x0000000005DD7000-memory.dmpFilesize
3.3MB
-
memory/3212-68-0x0000000006020000-0x000000000606C000-memory.dmpFilesize
304KB
-
memory/3212-71-0x00000000712C0000-0x0000000071617000-memory.dmpFilesize
3.3MB
-
memory/3212-70-0x00000000710B0000-0x00000000710FC000-memory.dmpFilesize
304KB
-
memory/3212-56-0x0000000074DD0000-0x0000000075581000-memory.dmpFilesize
7.7MB
-
memory/3212-82-0x0000000002B00000-0x0000000002B10000-memory.dmpFilesize
64KB
-
memory/3212-81-0x0000000002B00000-0x0000000002B10000-memory.dmpFilesize
64KB
-
memory/3212-80-0x00000000071F0000-0x0000000007294000-memory.dmpFilesize
656KB
-
memory/3212-83-0x0000000007520000-0x0000000007531000-memory.dmpFilesize
68KB
-
memory/3212-84-0x0000000007570000-0x0000000007585000-memory.dmpFilesize
84KB
-
memory/3212-87-0x0000000074DD0000-0x0000000075581000-memory.dmpFilesize
7.7MB
-
memory/3436-269-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-267-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-265-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-263-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-261-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-259-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-257-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-255-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-246-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3436-184-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3812-27-0x0000000071170000-0x00000000714C7000-memory.dmpFilesize
3.3MB
-
memory/3812-7-0x00000000046E0000-0x00000000046F0000-memory.dmpFilesize
64KB
-
memory/3812-36-0x0000000006E50000-0x0000000006E6E000-memory.dmpFilesize
120KB
-
memory/3812-37-0x0000000006E70000-0x0000000006F14000-memory.dmpFilesize
656KB
-
memory/3812-26-0x0000000070FA0000-0x0000000070FEC000-memory.dmpFilesize
304KB
-
memory/3812-25-0x0000000006E10000-0x0000000006E44000-memory.dmpFilesize
208KB
-
memory/3812-24-0x000000007FCC0000-0x000000007FCD0000-memory.dmpFilesize
64KB
-
memory/3812-23-0x0000000005F90000-0x0000000005FD6000-memory.dmpFilesize
280KB
-
memory/3812-22-0x0000000005A20000-0x0000000005A6C000-memory.dmpFilesize
304KB
-
memory/3812-21-0x00000000059D0000-0x00000000059EE000-memory.dmpFilesize
120KB
-
memory/3812-20-0x0000000005500000-0x0000000005857000-memory.dmpFilesize
3.3MB
-
memory/3812-11-0x0000000005350000-0x00000000053B6000-memory.dmpFilesize
408KB
-
memory/3812-39-0x00000000075E0000-0x0000000007C5A000-memory.dmpFilesize
6.5MB
-
memory/3812-10-0x0000000004BC0000-0x0000000004C26000-memory.dmpFilesize
408KB
-
memory/3812-9-0x0000000004B20000-0x0000000004B42000-memory.dmpFilesize
136KB
-
memory/3812-38-0x00000000046E0000-0x00000000046F0000-memory.dmpFilesize
64KB
-
memory/3812-40-0x0000000006FA0000-0x0000000006FBA000-memory.dmpFilesize
104KB
-
memory/3812-8-0x0000000004D20000-0x000000000534A000-memory.dmpFilesize
6.2MB
-
memory/3812-6-0x00000000046E0000-0x00000000046F0000-memory.dmpFilesize
64KB
-
memory/3812-41-0x0000000006FE0000-0x0000000006FEA000-memory.dmpFilesize
40KB
-
memory/3812-5-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB
-
memory/3812-42-0x00000000070F0000-0x0000000007186000-memory.dmpFilesize
600KB
-
memory/3812-43-0x0000000007000000-0x0000000007011000-memory.dmpFilesize
68KB
-
memory/3812-4-0x0000000004560000-0x0000000004596000-memory.dmpFilesize
216KB
-
memory/3812-44-0x0000000007050000-0x000000000705E000-memory.dmpFilesize
56KB
-
memory/3812-45-0x0000000007060000-0x0000000007075000-memory.dmpFilesize
84KB
-
memory/3812-46-0x00000000070B0000-0x00000000070CA000-memory.dmpFilesize
104KB
-
memory/3812-47-0x00000000070D0000-0x00000000070D8000-memory.dmpFilesize
32KB
-
memory/3812-50-0x0000000074D30000-0x00000000754E1000-memory.dmpFilesize
7.7MB