Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe
Resource
win10v2004-20240412-en
General
-
Target
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe
-
Size
4.2MB
-
MD5
4c86430e2a35691b0b38cce6cde9255d
-
SHA1
bc6c21527c29c084b11c1088d80d51396f5eb8a8
-
SHA256
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0
-
SHA512
cdad7e37bd3860e0a5a45f738950f831eb4a2376f3dfce979b67887f6d45321030a2a4b327f56d123434039bcbd018a1561823ce0423e4b96deba48823d38834
-
SSDEEP
98304:SB6TE4JDSTIitXqfSjBwF+v4rSSNjcdSqGUwT7RQU7O+:PTFmTI8qKjKFA4r+dAh7RQUn
Malware Config
Signatures
-
Glupteba payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-2-0x00000000041A0000-0x0000000004A8B000-memory.dmp family_glupteba behavioral2/memory/4872-3-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3068-53-0x0000000003FB0000-0x000000000489B000-memory.dmp family_glupteba behavioral2/memory/3068-55-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4872-66-0x00000000041A0000-0x0000000004A8B000-memory.dmp family_glupteba behavioral2/memory/4872-80-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3068-138-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3068-146-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-237-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-245-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-249-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-252-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-255-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-258-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-261-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-264-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-267-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-270-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-273-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-276-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2284-279-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2888 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2284 csrss.exe 4352 injector.exe 5756 windefender.exe 3452 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/5756-246-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3452-250-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3452-256-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe -
Drops file in Windows directory 4 IoCs
Processes:
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe File created C:\Windows\rss\csrss.exe 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1456 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5888 schtasks.exe 1404 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exepowershell.exepowershell.exe7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exepowershell.exe7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4276 powershell.exe 4276 powershell.exe 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 5960 powershell.exe 5960 powershell.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe 1952 powershell.exe 1952 powershell.exe 2984 powershell.exe 2984 powershell.exe 2556 powershell.exe 2556 powershell.exe 1312 powershell.exe 1312 powershell.exe 4728 powershell.exe 4728 powershell.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 2284 csrss.exe 2284 csrss.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 2284 csrss.exe 2284 csrss.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 2284 csrss.exe 2284 csrss.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe 4352 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4276 powershell.exe Token: SeDebugPrivilege 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Token: SeImpersonatePrivilege 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe Token: SeDebugPrivilege 5960 powershell.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 1312 powershell.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeSystemEnvironmentPrivilege 2284 csrss.exe Token: SeSecurityPrivilege 1456 sc.exe Token: SeSecurityPrivilege 1456 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4872 wrote to memory of 4276 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 4872 wrote to memory of 4276 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 4872 wrote to memory of 4276 4872 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 5960 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 5960 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 5960 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 3176 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe cmd.exe PID 3068 wrote to memory of 3176 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe cmd.exe PID 3176 wrote to memory of 2888 3176 cmd.exe netsh.exe PID 3176 wrote to memory of 2888 3176 cmd.exe netsh.exe PID 3068 wrote to memory of 1952 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 1952 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 1952 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 2984 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 2984 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 2984 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe powershell.exe PID 3068 wrote to memory of 2284 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe csrss.exe PID 3068 wrote to memory of 2284 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe csrss.exe PID 3068 wrote to memory of 2284 3068 7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe csrss.exe PID 2284 wrote to memory of 2556 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 2556 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 2556 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 1312 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 1312 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 1312 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 4728 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 4728 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 4728 2284 csrss.exe powershell.exe PID 2284 wrote to memory of 4352 2284 csrss.exe injector.exe PID 2284 wrote to memory of 4352 2284 csrss.exe injector.exe PID 5756 wrote to memory of 1516 5756 windefender.exe cmd.exe PID 5756 wrote to memory of 1516 5756 windefender.exe cmd.exe PID 5756 wrote to memory of 1516 5756 windefender.exe cmd.exe PID 1516 wrote to memory of 1456 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1456 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1456 1516 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe"C:\Users\Admin\AppData\Local\Temp\7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe"C:\Users\Admin\AppData\Local\Temp\7f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_waibfdug.soz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e298c95063b6b20cf626bab4063cca1e
SHA178565b3751bbdaedf66bf297c0cf2b351c869f9e
SHA2567ba7af16559a8a9b0b6f38750a3e95ffada7e2690295748e40d767449484fd68
SHA51277c8f571e65ef93e4491ce174797a91b31ea43375dd8f1612030f1963822591da2d8c15d302a9121ebd2a8c0dcccd2c7ec846132fb90bd5eaf7bf88ed5f55972
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD526edd123d65b9b021c328268a04dc79d
SHA12422413c50d6ca71e73d0c678e07bc02382cfd0b
SHA256dd1dc29b0105bf7dc3f1c2b7052963c75069d5c360e05fdd09232692d2a26200
SHA51228fd94c7eee517bce638fa89f348bc892e1b1366a902d1a839a1120850b378cf8e196a36132102445534fc52e89bb4589d990d9f48c54241a3b3b4b097e154b6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD561e3b504b7715822fdb845548640baa7
SHA1529c9125c1856d190bcc857a03246a279ae090bf
SHA256069ad47c4a806079a07e48e8594e52c80840d08aab5be5173f74aba287d1b605
SHA5125bf3439eae53962abff9fef94da3a07ad7678adbd71a05f67bac543d70460f2238cef62a9bf9392832def1c699821e4602b985ed35e61ff325f73a60cc032dfc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51004d512743cd1317bcba02565339f1d
SHA102557981345290d6faf611ca2652871c12b2ecbd
SHA256b597d0af51b1216c1588aee17ca78c28bb1748d42699f31102208ae1340f9440
SHA512552772fdb6b21e2d732a7938652aca4c0b3322ab057cc60c0ee73d0a1a4412f90f7540306d689dca217f9994ab52591cc70044c1960d67539691c90547c221ee
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54f9446c7cb85b4550b11192700742c70
SHA1c2a2161040ea3ac5b134df2809788c88ac810e58
SHA256e82b10ce1cea580b32a5514629cffb92c4e16c03c7574e9a8c6932c1024f06a0
SHA512e4990c8f01588368cb98e75ac59be1b7269662f2e986134975454d6d8d6ee087b2aff005b1d9aed6d5e153ef533158e27fe679e57857ddc5b9529fc928643c30
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD54c86430e2a35691b0b38cce6cde9255d
SHA1bc6c21527c29c084b11c1088d80d51396f5eb8a8
SHA2567f54c76d79940af03f00b3b9b537536ebd74d1f57b7c5da45f9a2ec0b6b3bea0
SHA512cdad7e37bd3860e0a5a45f738950f831eb4a2376f3dfce979b67887f6d45321030a2a4b327f56d123434039bcbd018a1561823ce0423e4b96deba48823d38834
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1952-100-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/1952-89-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/1952-112-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/1952-101-0x0000000070BE0000-0x0000000070F37000-memory.dmpFilesize
3.3MB
-
memory/1952-110-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/1952-88-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/1952-99-0x000000007F660000-0x000000007F670000-memory.dmpFilesize
64KB
-
memory/1952-87-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/2284-255-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-245-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-270-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-252-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-279-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-276-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-237-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-267-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-264-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-261-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-258-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-249-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2284-273-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2984-120-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/2984-114-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/2984-122-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/2984-121-0x0000000005550000-0x00000000058A7000-memory.dmpFilesize
3.3MB
-
memory/2984-128-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/2984-129-0x0000000070C70000-0x0000000070FC7000-memory.dmpFilesize
3.3MB
-
memory/3068-146-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3068-55-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3068-53-0x0000000003FB0000-0x000000000489B000-memory.dmpFilesize
8.9MB
-
memory/3068-52-0x0000000003BB0000-0x0000000003FAD000-memory.dmpFilesize
4.0MB
-
memory/3068-126-0x0000000003BB0000-0x0000000003FAD000-memory.dmpFilesize
4.0MB
-
memory/3068-138-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3452-250-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3452-256-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4276-38-0x0000000006FB0000-0x0000000007054000-memory.dmpFilesize
656KB
-
memory/4276-21-0x0000000005B30000-0x0000000005B4E000-memory.dmpFilesize
120KB
-
memory/4276-4-0x0000000002320000-0x0000000002356000-memory.dmpFilesize
216KB
-
memory/4276-5-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/4276-6-0x0000000004770000-0x0000000004780000-memory.dmpFilesize
64KB
-
memory/4276-8-0x0000000004DB0000-0x00000000053DA000-memory.dmpFilesize
6.2MB
-
memory/4276-7-0x0000000004770000-0x0000000004780000-memory.dmpFilesize
64KB
-
memory/4276-9-0x0000000004B60000-0x0000000004B82000-memory.dmpFilesize
136KB
-
memory/4276-10-0x0000000004D00000-0x0000000004D66000-memory.dmpFilesize
408KB
-
memory/4276-11-0x0000000005450000-0x00000000054B6000-memory.dmpFilesize
408KB
-
memory/4276-20-0x0000000005640000-0x0000000005997000-memory.dmpFilesize
3.3MB
-
memory/4276-22-0x0000000005B60000-0x0000000005BAC000-memory.dmpFilesize
304KB
-
memory/4276-23-0x0000000006B30000-0x0000000006B76000-memory.dmpFilesize
280KB
-
memory/4276-24-0x000000007F250000-0x000000007F260000-memory.dmpFilesize
64KB
-
memory/4276-50-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/4276-47-0x0000000007210000-0x0000000007218000-memory.dmpFilesize
32KB
-
memory/4276-46-0x00000000071F0000-0x000000000720A000-memory.dmpFilesize
104KB
-
memory/4276-45-0x00000000071A0000-0x00000000071B5000-memory.dmpFilesize
84KB
-
memory/4276-44-0x0000000007190000-0x000000000719E000-memory.dmpFilesize
56KB
-
memory/4276-43-0x0000000007140000-0x0000000007151000-memory.dmpFilesize
68KB
-
memory/4276-42-0x0000000007230000-0x00000000072C6000-memory.dmpFilesize
600KB
-
memory/4276-41-0x0000000007120000-0x000000000712A000-memory.dmpFilesize
40KB
-
memory/4276-40-0x00000000070E0000-0x00000000070FA000-memory.dmpFilesize
104KB
-
memory/4276-39-0x0000000007720000-0x0000000007D9A000-memory.dmpFilesize
6.5MB
-
memory/4276-26-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/4276-37-0x0000000004770000-0x0000000004780000-memory.dmpFilesize
64KB
-
memory/4276-36-0x0000000006F90000-0x0000000006FAE000-memory.dmpFilesize
120KB
-
memory/4276-27-0x0000000070BE0000-0x0000000070F37000-memory.dmpFilesize
3.3MB
-
memory/4276-25-0x0000000006F50000-0x0000000006F84000-memory.dmpFilesize
208KB
-
memory/4872-80-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4872-54-0x0000000003D90000-0x0000000004194000-memory.dmpFilesize
4.0MB
-
memory/4872-2-0x00000000041A0000-0x0000000004A8B000-memory.dmpFilesize
8.9MB
-
memory/4872-1-0x0000000003D90000-0x0000000004194000-memory.dmpFilesize
4.0MB
-
memory/4872-3-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4872-66-0x00000000041A0000-0x0000000004A8B000-memory.dmpFilesize
8.9MB
-
memory/5756-246-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5960-56-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/5960-69-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/5960-70-0x0000000070BE0000-0x0000000070F37000-memory.dmpFilesize
3.3MB
-
memory/5960-68-0x000000007F720000-0x000000007F730000-memory.dmpFilesize
64KB
-
memory/5960-79-0x0000000006D70000-0x0000000006E14000-memory.dmpFilesize
656KB
-
memory/5960-67-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/5960-85-0x00000000747F0000-0x0000000074FA1000-memory.dmpFilesize
7.7MB
-
memory/5960-82-0x0000000007100000-0x0000000007115000-memory.dmpFilesize
84KB
-
memory/5960-81-0x00000000070B0000-0x00000000070C1000-memory.dmpFilesize
68KB
-
memory/5960-57-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB