Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 08:18
Static task
static1
Behavioral task
behavioral1
Sample
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe
Resource
win10v2004-20240412-en
General
-
Target
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe
-
Size
4.2MB
-
MD5
5f2487ded6768e0d2869e6825a7d9e4f
-
SHA1
112b2535a6e692cfa867dc932443c3b6f580280f
-
SHA256
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd
-
SHA512
1a941898b9421bd879c4e75b9073768fa02b02abd68138c7d7665b043d6ef201a0d5130ef03f81e3989f69dae40767652149b7e1665cd518a7cc656bdd624865
-
SSDEEP
98304:iS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORv:TEcJzF4UNHqA/dsmoVS4YAf19s
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/3856-2-0x0000000004210000-0x0000000004AFB000-memory.dmp family_glupteba behavioral2/memory/3856-3-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1644-53-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3856-54-0x0000000004210000-0x0000000004AFB000-memory.dmp family_glupteba behavioral2/memory/3856-69-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1644-129-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1644-188-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-238-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-248-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-252-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-256-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-260-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-264-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-268-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-272-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-276-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-280-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-284-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-288-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3300-292-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2064 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3300 csrss.exe 3768 injector.exe 2456 windefender.exe 1332 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/2456-246-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1332-250-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1332-258-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1332-262-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe -
Drops file in Windows directory 4 IoCs
Processes:
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 660 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 420 schtasks.exe 1548 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exepowershell.exe3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exepowershell.exe3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2736 powershell.exe 2736 powershell.exe 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 4460 powershell.exe 4460 powershell.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe 4980 powershell.exe 4980 powershell.exe 440 powershell.exe 440 powershell.exe 2212 powershell.exe 2212 powershell.exe 2332 powershell.exe 2332 powershell.exe 1860 powershell.exe 1860 powershell.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3300 csrss.exe 3300 csrss.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3300 csrss.exe 3300 csrss.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3300 csrss.exe 3300 csrss.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe 3768 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Token: SeImpersonatePrivilege 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 440 powershell.exe Token: SeDebugPrivilege 2212 powershell.exe Token: SeDebugPrivilege 2332 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeSystemEnvironmentPrivilege 3300 csrss.exe Token: SeSecurityPrivilege 660 sc.exe Token: SeSecurityPrivilege 660 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3856 wrote to memory of 2736 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 3856 wrote to memory of 2736 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 3856 wrote to memory of 2736 3856 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 4460 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 4460 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 4460 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 2948 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe cmd.exe PID 1644 wrote to memory of 2948 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe cmd.exe PID 2948 wrote to memory of 2064 2948 cmd.exe netsh.exe PID 2948 wrote to memory of 2064 2948 cmd.exe netsh.exe PID 1644 wrote to memory of 4980 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 4980 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 4980 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 440 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 440 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 440 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe powershell.exe PID 1644 wrote to memory of 3300 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe csrss.exe PID 1644 wrote to memory of 3300 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe csrss.exe PID 1644 wrote to memory of 3300 1644 3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe csrss.exe PID 3300 wrote to memory of 2212 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 2212 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 2212 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 2332 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 2332 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 2332 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 1860 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 1860 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 1860 3300 csrss.exe powershell.exe PID 3300 wrote to memory of 3768 3300 csrss.exe injector.exe PID 3300 wrote to memory of 3768 3300 csrss.exe injector.exe PID 2456 wrote to memory of 4476 2456 windefender.exe cmd.exe PID 2456 wrote to memory of 4476 2456 windefender.exe cmd.exe PID 2456 wrote to memory of 4476 2456 windefender.exe cmd.exe PID 4476 wrote to memory of 660 4476 cmd.exe sc.exe PID 4476 wrote to memory of 660 4476 cmd.exe sc.exe PID 4476 wrote to memory of 660 4476 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe"C:\Users\Admin\AppData\Local\Temp\3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe"C:\Users\Admin\AppData\Local\Temp\3dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fr2hkhhx.p4s.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54cac894edf2f00beeeca7c968ab08527
SHA1eca44f68a743396f8c8ab17910b9df703df485b3
SHA256c72120ef76a5bf304fae8bb194038da75f661fd2fb0c165d898c60cf65ba1032
SHA51285ae6fa3a5855305e4b73c7eb2837493e6f7d0262eb2f9602f5636daa191621677330212ddf224adb77a168049e8011af97a4ce5c5daf9fb51ba476b915147c3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56bef358c53fbc72edd79a6db26578289
SHA134e1b7d2c055ee15a4f2f1a32f94ad4caeaceb45
SHA2563b063a146c158db3dee5efed55a016c5c7343f2e7339596ed73f726875868985
SHA5123c487dd9903f2e00a716e5e5e1ead05a660825dcf374ce711b5357982ecfca2c328c662cb637d361be74f61e594fc0e8007315c5702479f838b90298c9f418df
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53fc7168696618af8925e39b772957498
SHA1816c1f451a5de4029055c0910f1c5fd50ee458d0
SHA25646fcaae8d84722fd7bbe5922df3c0c86c5731bb9ed17e63c19a4779f06210fa5
SHA512d6e5fd5b9d76e53df211521ead0b2024568c6b899af101871e098d1fdf6614f0a7fe948bb71502a83bd8b3ab1a6c6a533671fe7edaeca8bedb2483b1f5f10b51
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5be56da208dd8abdaf10d69e5f448b538
SHA1383c6590e84275f0a0e68e76c1ae21388cfafdfc
SHA25662dc6ff200ee8d1997b595a85da21c8c9797e6f29e45b77d64c2e4b07eb34c0b
SHA51283fa5561af234d40dde00fdfbcc1d1dd494bed41699d1eacb5b656e37c65c3efcda8b9db028fbc241d92b430241032e0e4186a3e95798e484fa6831930a82a3c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5cf77748ae3f5ff769f54747e70c97b2b
SHA1df4d7ff4b59b7d0d7023eb32b60c0dcf78da5486
SHA2565d1ecd0776599c400614d1630085a158e07159a49ad3939bced722a0a467db4f
SHA512c773bcf0ee99bad36831c69eb541fa579d978d3f485d8fe501ad2b1a4a42eed1d4fb902a91fa7939a8f2514153fa31262b6cc9166abb626f0337f51b781650a1
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD55f2487ded6768e0d2869e6825a7d9e4f
SHA1112b2535a6e692cfa867dc932443c3b6f580280f
SHA2563dca82e08a7b86c5d3de1ea212b7d01cbe6ac61ff29c893c97bf3ee12ee6ddbd
SHA5121a941898b9421bd879c4e75b9073768fa02b02abd68138c7d7665b043d6ef201a0d5130ef03f81e3989f69dae40767652149b7e1665cd518a7cc656bdd624865
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/440-127-0x00000000704C0000-0x000000007050C000-memory.dmpFilesize
304KB
-
memory/440-115-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/440-125-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/440-138-0x000000007EF30000-0x000000007EF40000-memory.dmpFilesize
64KB
-
memory/440-128-0x0000000070710000-0x0000000070A67000-memory.dmpFilesize
3.3MB
-
memory/440-116-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/1332-250-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1332-258-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1332-262-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1644-188-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1644-129-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1644-51-0x0000000003D10000-0x000000000410E000-memory.dmpFilesize
4.0MB
-
memory/1644-110-0x0000000003D10000-0x000000000410E000-memory.dmpFilesize
4.0MB
-
memory/1644-53-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/2456-246-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2736-38-0x0000000008500000-0x0000000008B7A000-memory.dmpFilesize
6.5MB
-
memory/2736-20-0x0000000006280000-0x00000000065D7000-memory.dmpFilesize
3.3MB
-
memory/2736-43-0x0000000007F70000-0x0000000007F7E000-memory.dmpFilesize
56KB
-
memory/2736-44-0x0000000007F80000-0x0000000007F95000-memory.dmpFilesize
84KB
-
memory/2736-45-0x0000000007FD0000-0x0000000007FEA000-memory.dmpFilesize
104KB
-
memory/2736-46-0x0000000007FF0000-0x0000000007FF8000-memory.dmpFilesize
32KB
-
memory/2736-49-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/2736-41-0x0000000008010000-0x00000000080A6000-memory.dmpFilesize
600KB
-
memory/2736-9-0x00000000059C0000-0x00000000059E2000-memory.dmpFilesize
136KB
-
memory/2736-40-0x0000000007F00000-0x0000000007F0A000-memory.dmpFilesize
40KB
-
memory/2736-10-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/2736-11-0x0000000005AD0000-0x0000000005B36000-memory.dmpFilesize
408KB
-
memory/2736-8-0x0000000005C50000-0x000000000627A000-memory.dmpFilesize
6.2MB
-
memory/2736-39-0x0000000007EC0000-0x0000000007EDA000-memory.dmpFilesize
104KB
-
memory/2736-21-0x0000000006870000-0x000000000688E000-memory.dmpFilesize
120KB
-
memory/2736-22-0x0000000006920000-0x000000000696C000-memory.dmpFilesize
304KB
-
memory/2736-42-0x0000000007F20000-0x0000000007F31000-memory.dmpFilesize
68KB
-
memory/2736-23-0x00000000079F0000-0x0000000007A36000-memory.dmpFilesize
280KB
-
memory/2736-26-0x00000000704C0000-0x000000007050C000-memory.dmpFilesize
304KB
-
memory/2736-25-0x0000000007D30000-0x0000000007D64000-memory.dmpFilesize
208KB
-
memory/2736-24-0x000000007F370000-0x000000007F380000-memory.dmpFilesize
64KB
-
memory/2736-36-0x0000000007D70000-0x0000000007D8E000-memory.dmpFilesize
120KB
-
memory/2736-27-0x00000000706F0000-0x0000000070A47000-memory.dmpFilesize
3.3MB
-
memory/2736-7-0x00000000033F0000-0x0000000003400000-memory.dmpFilesize
64KB
-
memory/2736-37-0x0000000007D90000-0x0000000007E34000-memory.dmpFilesize
656KB
-
memory/2736-6-0x00000000033F0000-0x0000000003400000-memory.dmpFilesize
64KB
-
memory/2736-5-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/2736-4-0x00000000033A0000-0x00000000033D6000-memory.dmpFilesize
216KB
-
memory/3300-288-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-276-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-252-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-256-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-238-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-292-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-284-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-260-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-280-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-264-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-268-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-272-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3300-248-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3856-69-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3856-2-0x0000000004210000-0x0000000004AFB000-memory.dmpFilesize
8.9MB
-
memory/3856-3-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3856-1-0x0000000003E00000-0x0000000004202000-memory.dmpFilesize
4.0MB
-
memory/3856-54-0x0000000004210000-0x0000000004AFB000-memory.dmpFilesize
8.9MB
-
memory/3856-52-0x0000000003E00000-0x0000000004202000-memory.dmpFilesize
4.0MB
-
memory/4460-67-0x00000000704C0000-0x000000007050C000-memory.dmpFilesize
304KB
-
memory/4460-79-0x000000007EEE0000-0x000000007EEF0000-memory.dmpFilesize
64KB
-
memory/4460-55-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/4460-57-0x0000000002840000-0x0000000002850000-memory.dmpFilesize
64KB
-
memory/4460-58-0x0000000002840000-0x0000000002850000-memory.dmpFilesize
64KB
-
memory/4460-56-0x00000000056A0000-0x00000000059F7000-memory.dmpFilesize
3.3MB
-
memory/4460-68-0x0000000070710000-0x0000000070A67000-memory.dmpFilesize
3.3MB
-
memory/4460-80-0x0000000002840000-0x0000000002850000-memory.dmpFilesize
64KB
-
memory/4460-78-0x0000000006DB0000-0x0000000006E54000-memory.dmpFilesize
656KB
-
memory/4460-85-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/4460-82-0x0000000007150000-0x0000000007165000-memory.dmpFilesize
84KB
-
memory/4460-81-0x0000000007100000-0x0000000007111000-memory.dmpFilesize
68KB
-
memory/4980-89-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/4980-113-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/4980-88-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/4980-87-0x0000000074250000-0x0000000074A01000-memory.dmpFilesize
7.7MB
-
memory/4980-100-0x00000000704C0000-0x000000007050C000-memory.dmpFilesize
304KB
-
memory/4980-99-0x000000007F020000-0x000000007F030000-memory.dmpFilesize
64KB
-
memory/4980-101-0x00000000706F0000-0x0000000070A47000-memory.dmpFilesize
3.3MB
-
memory/4980-111-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB