Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 16:21
Static task
static1
Behavioral task
behavioral1
Sample
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe
Resource
win10v2004-20240412-en
General
-
Target
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe
-
Size
4.2MB
-
MD5
f07c4baff0a4810fe487d605125b73b0
-
SHA1
0c2d5c17d23ff5ffcb07da7a7b64d1c1b0a3886f
-
SHA256
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918
-
SHA512
ef53de545f1f61bc8ae93de6a4858088d0bd9b6130013da70c78ecce320b8a404d63356061164b1e550d0d382f119e388c906cc71cfedafa244915c7c9525c2e
-
SSDEEP
49152:Qr1oHj0tlV0f9s8MWzX04BUpcYbKwdRAyQZQ93cNVdRbmMzimZc5ZnjMAqqwRi8X:QBcwtA9b44emOBqNRUORBLE4Ajzw
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/1524-2-0x0000000004130000-0x0000000004A1B000-memory.dmp family_glupteba behavioral2/memory/1524-3-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/5092-53-0x0000000003F40000-0x000000000482B000-memory.dmp family_glupteba behavioral2/memory/5092-54-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1524-86-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/5092-137-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/5092-144-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-242-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-252-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-254-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-258-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-261-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-264-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-267-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-270-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-272-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-276-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-279-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-282-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2744-285-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 5008 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2744 csrss.exe 1208 injector.exe 4804 windefender.exe 1164 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4804-251-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1164-255-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1164-260-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1164-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe File created C:\Windows\rss\csrss.exe 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4872 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1392 schtasks.exe 1248 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-492 = "India Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exepowershell.exe22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4296 powershell.exe 4296 powershell.exe 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 4616 powershell.exe 4616 powershell.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe 2988 powershell.exe 2988 powershell.exe 1504 powershell.exe 1504 powershell.exe 2224 powershell.exe 2224 powershell.exe 2780 powershell.exe 2780 powershell.exe 2504 powershell.exe 2504 powershell.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 2744 csrss.exe 2744 csrss.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 2744 csrss.exe 2744 csrss.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 2744 csrss.exe 2744 csrss.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe 1208 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Token: SeImpersonatePrivilege 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 2780 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeSystemEnvironmentPrivilege 2744 csrss.exe Token: SeSecurityPrivilege 4872 sc.exe Token: SeSecurityPrivilege 4872 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 1524 wrote to memory of 4296 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 1524 wrote to memory of 4296 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 1524 wrote to memory of 4296 1524 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 4616 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 4616 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 4616 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 4052 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe cmd.exe PID 5092 wrote to memory of 4052 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe cmd.exe PID 4052 wrote to memory of 5008 4052 cmd.exe netsh.exe PID 4052 wrote to memory of 5008 4052 cmd.exe netsh.exe PID 5092 wrote to memory of 2988 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 2988 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 2988 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 1504 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 1504 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 1504 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe powershell.exe PID 5092 wrote to memory of 2744 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe csrss.exe PID 5092 wrote to memory of 2744 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe csrss.exe PID 5092 wrote to memory of 2744 5092 22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe csrss.exe PID 2744 wrote to memory of 2224 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2224 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2224 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2780 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2780 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2780 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2504 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2504 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 2504 2744 csrss.exe powershell.exe PID 2744 wrote to memory of 1208 2744 csrss.exe injector.exe PID 2744 wrote to memory of 1208 2744 csrss.exe injector.exe PID 4804 wrote to memory of 2076 4804 windefender.exe cmd.exe PID 4804 wrote to memory of 2076 4804 windefender.exe cmd.exe PID 4804 wrote to memory of 2076 4804 windefender.exe cmd.exe PID 2076 wrote to memory of 4872 2076 cmd.exe sc.exe PID 2076 wrote to memory of 4872 2076 cmd.exe sc.exe PID 2076 wrote to memory of 4872 2076 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe"C:\Users\Admin\AppData\Local\Temp\22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe"C:\Users\Admin\AppData\Local\Temp\22c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjto4cnt.cxn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57a2c52dab77496b991c204e631663f00
SHA14d826e73fa100644df6832b3e781c760fd1b0b59
SHA256bb975da691b4ecf833a3e1e625cc3478d4065d505dd2799bb029839b070eff78
SHA5124b3f639e24c66811503ebe27d9ee6aa674041ac5257e2df7d02129e844cce4dadfe5f8d72bfd774e667351a478cb58e562ad43977848cdb912157606465190a0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD556907cff34e1f0740dbac6de90a19a03
SHA1eb959eaad5ccbf54413e3d4f4f7d3fac8603071a
SHA2567d7f6659e0bb29719fe0974f7003826216f05c6ea9c990e98becfd00a8635a89
SHA512b41660b167001144809bbe37b5cb80d8caf4ed6508ecc2d96836d59b0d380da402814fb9d485e2ce3d8cc51e941c0f6d63bbcd6119b7519cc7e6de8ad6fa190b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ec2ec4312a0b54c59bacbb02b6fdd2f1
SHA1dbbf3d3d57de727a8e380e6f7b71427426f69dec
SHA2560eba0275e16e9a9c80cda81461d95da7e3ea384bf342fc5520ca06593c91857c
SHA5125224de2592e00fd8f31a7cbf607786ccfc25643c9af51d330b051b0f7f84b29b003c761ffcc19e9394b5eb1dc82fa9b0f1def93781c0857845fb54541ca9f2e7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54dd61fb7d12d855352b9e798260c4004
SHA12177b7da24a9d18c6aeffb30f98f87e3db65d810
SHA2562afc43f113bc3f1c7d90064b49fd2e60cf4c020dba8a9df089b134a1246f8e91
SHA512b14f21986fb69670288b62cf03726bec8a647ebbc53b6395043ed7738648f41316bd96ee85ed9d5e31c5b252c60cfb6d04a1cd104c8972452e3bc3b319ae176b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD555af1402e2249e003740fb4ea19a7f46
SHA11d2b962c1e7edf94dd678c4e975ad333f1e01be9
SHA2563ddecee70e92ab2da128bc88430d0becec18355d1c27ba62160ddd5e471f54a9
SHA512689486f89b1ae65ef23d70630fad9eaad01b1f381b246f97d9721c3e7c3fbfec2c937c85e3b8b947e322aedc18d1de4292db821680b5460ca6661b38cd50c25d
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5f07c4baff0a4810fe487d605125b73b0
SHA10c2d5c17d23ff5ffcb07da7a7b64d1c1b0a3886f
SHA25622c77e5da0a7240bc01df31549f16d2dc3e24a9aeaeb2ecf1cc0c861c6e87918
SHA512ef53de545f1f61bc8ae93de6a4858088d0bd9b6130013da70c78ecce320b8a404d63356061164b1e550d0d382f119e388c906cc71cfedafa244915c7c9525c2e
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1164-269-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1164-260-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1164-255-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1504-128-0x0000000070960000-0x0000000070CB7000-memory.dmpFilesize
3.3MB
-
memory/1504-138-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/1504-116-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/1504-115-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/1504-127-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/1524-55-0x0000000003D20000-0x0000000004127000-memory.dmpFilesize
4.0MB
-
memory/1524-3-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1524-1-0x0000000003D20000-0x0000000004127000-memory.dmpFilesize
4.0MB
-
memory/1524-2-0x0000000004130000-0x0000000004A1B000-memory.dmpFilesize
8.9MB
-
memory/1524-86-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-285-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-276-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-272-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-279-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-242-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-252-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-254-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-258-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-261-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-264-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-270-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-282-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2744-267-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2988-101-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/2988-111-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/2988-112-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/2988-100-0x000000007F3A0000-0x000000007F3B0000-memory.dmpFilesize
64KB
-
memory/2988-102-0x0000000070A30000-0x0000000070D87000-memory.dmpFilesize
3.3MB
-
memory/2988-90-0x0000000005FF0000-0x0000000006347000-memory.dmpFilesize
3.3MB
-
memory/2988-89-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/2988-88-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/2988-114-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/4296-39-0x0000000007F00000-0x000000000857A000-memory.dmpFilesize
6.5MB
-
memory/4296-25-0x000000007F570000-0x000000007F580000-memory.dmpFilesize
64KB
-
memory/4296-4-0x0000000002E50000-0x0000000002E86000-memory.dmpFilesize
216KB
-
memory/4296-6-0x00000000054D0000-0x0000000005AFA000-memory.dmpFilesize
6.2MB
-
memory/4296-7-0x0000000002D60000-0x0000000002D70000-memory.dmpFilesize
64KB
-
memory/4296-5-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/4296-8-0x0000000002D60000-0x0000000002D70000-memory.dmpFilesize
64KB
-
memory/4296-9-0x0000000005460000-0x0000000005482000-memory.dmpFilesize
136KB
-
memory/4296-11-0x0000000005CE0000-0x0000000005D46000-memory.dmpFilesize
408KB
-
memory/4296-10-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/4296-20-0x0000000005DD0000-0x0000000006127000-memory.dmpFilesize
3.3MB
-
memory/4296-21-0x0000000006310000-0x000000000632E000-memory.dmpFilesize
120KB
-
memory/4296-22-0x0000000006350000-0x000000000639C000-memory.dmpFilesize
304KB
-
memory/4296-23-0x00000000068C0000-0x0000000006906000-memory.dmpFilesize
280KB
-
memory/4296-26-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/4296-50-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/4296-47-0x00000000079F0000-0x00000000079F8000-memory.dmpFilesize
32KB
-
memory/4296-24-0x0000000007740000-0x0000000007774000-memory.dmpFilesize
208KB
-
memory/4296-46-0x00000000079D0000-0x00000000079EA000-memory.dmpFilesize
104KB
-
memory/4296-45-0x0000000007980000-0x0000000007995000-memory.dmpFilesize
84KB
-
memory/4296-44-0x0000000007970000-0x000000000797E000-memory.dmpFilesize
56KB
-
memory/4296-43-0x0000000007920000-0x0000000007931000-memory.dmpFilesize
68KB
-
memory/4296-27-0x0000000070960000-0x0000000070CB7000-memory.dmpFilesize
3.3MB
-
memory/4296-42-0x0000000007A10000-0x0000000007AA6000-memory.dmpFilesize
600KB
-
memory/4296-36-0x0000000007780000-0x000000000779E000-memory.dmpFilesize
120KB
-
memory/4296-41-0x0000000007900000-0x000000000790A000-memory.dmpFilesize
40KB
-
memory/4296-40-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/4296-38-0x00000000077A0000-0x0000000007844000-memory.dmpFilesize
656KB
-
memory/4296-37-0x0000000002D60000-0x0000000002D70000-memory.dmpFilesize
64KB
-
memory/4616-68-0x000000007F240000-0x000000007F250000-memory.dmpFilesize
64KB
-
memory/4616-69-0x0000000070960000-0x0000000070CB7000-memory.dmpFilesize
3.3MB
-
memory/4616-57-0x0000000004D60000-0x0000000004D70000-memory.dmpFilesize
64KB
-
memory/4616-60-0x0000000004D60000-0x0000000004D70000-memory.dmpFilesize
64KB
-
memory/4616-56-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/4616-81-0x00000000076E0000-0x00000000076F5000-memory.dmpFilesize
84KB
-
memory/4616-80-0x0000000007690000-0x00000000076A1000-memory.dmpFilesize
68KB
-
memory/4616-79-0x0000000004D60000-0x0000000004D70000-memory.dmpFilesize
64KB
-
memory/4616-84-0x0000000074570000-0x0000000074D21000-memory.dmpFilesize
7.7MB
-
memory/4616-78-0x0000000007360000-0x0000000007404000-memory.dmpFilesize
656KB
-
memory/4616-67-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/4804-251-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5092-117-0x0000000003B40000-0x0000000003F3F000-memory.dmpFilesize
4.0MB
-
memory/5092-144-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/5092-137-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/5092-54-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/5092-53-0x0000000003F40000-0x000000000482B000-memory.dmpFilesize
8.9MB
-
memory/5092-52-0x0000000003B40000-0x0000000003F3F000-memory.dmpFilesize
4.0MB