Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe
Resource
win10v2004-20240412-en
General
-
Target
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe
-
Size
4.2MB
-
MD5
99ad1872c94b0cb2b5090562786d3a88
-
SHA1
298edaaecfa7ac1e286fa8bef4b3bb455d2aa981
-
SHA256
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe
-
SHA512
6db0c23f1326bb82e528608e3951ff1e237bbde39ccd18db1d350e021b05e96dbc6eb3f30042c64513c86d0658c30092c401e8c61e1b97f38a4e370e05663725
-
SSDEEP
49152:Ir1oHj0tlV0f9s8MWzX04BUpcYbKwdRAyQZQ93cNVdRbmMzimZc5ZnjMAqqwRi8D:IBcwtA9b44emOBqNRUORBLE4AjzU
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-2-0x00000000040A0000-0x000000000498B000-memory.dmp family_glupteba behavioral2/memory/4972-3-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4748-53-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4972-55-0x00000000040A0000-0x000000000498B000-memory.dmp family_glupteba behavioral2/memory/4972-78-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4748-147-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-245-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-250-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-257-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-260-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-263-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-266-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-269-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-272-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-275-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-278-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-281-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-284-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/2412-287-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1588 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2412 csrss.exe 2628 injector.exe 3760 windefender.exe 4692 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/3760-254-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4692-258-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4692-264-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe -
Drops file in Windows directory 4 IoCs
Processes:
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.execsrss.exedescription ioc process File opened for modification C:\Windows\rss d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe File created C:\Windows\rss\csrss.exe d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 696 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4604 schtasks.exe 2448 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exepowershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exed4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exepowershell.exed4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 5044 powershell.exe 5044 powershell.exe 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 1608 powershell.exe 1608 powershell.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe 2384 powershell.exe 2384 powershell.exe 5092 powershell.exe 5092 powershell.exe 1504 powershell.exe 1504 powershell.exe 4064 powershell.exe 4064 powershell.exe 1932 powershell.exe 1932 powershell.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2412 csrss.exe 2412 csrss.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2412 csrss.exe 2412 csrss.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2412 csrss.exe 2412 csrss.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe 2628 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exed4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Token: SeImpersonatePrivilege 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 2384 powershell.exe Token: SeDebugPrivilege 5092 powershell.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeSystemEnvironmentPrivilege 2412 csrss.exe Token: SeSecurityPrivilege 696 sc.exe Token: SeSecurityPrivilege 696 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exed4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4972 wrote to memory of 5044 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4972 wrote to memory of 5044 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4972 wrote to memory of 5044 4972 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 1608 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 1608 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 1608 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 1260 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe cmd.exe PID 4748 wrote to memory of 1260 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe cmd.exe PID 1260 wrote to memory of 1588 1260 cmd.exe netsh.exe PID 1260 wrote to memory of 1588 1260 cmd.exe netsh.exe PID 4748 wrote to memory of 2384 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 2384 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 2384 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 5092 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 5092 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 5092 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe powershell.exe PID 4748 wrote to memory of 2412 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe csrss.exe PID 4748 wrote to memory of 2412 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe csrss.exe PID 4748 wrote to memory of 2412 4748 d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe csrss.exe PID 2412 wrote to memory of 1504 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 1504 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 1504 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 4064 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 4064 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 4064 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 1932 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 1932 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 1932 2412 csrss.exe powershell.exe PID 2412 wrote to memory of 2628 2412 csrss.exe injector.exe PID 2412 wrote to memory of 2628 2412 csrss.exe injector.exe PID 3760 wrote to memory of 3492 3760 windefender.exe cmd.exe PID 3760 wrote to memory of 3492 3760 windefender.exe cmd.exe PID 3760 wrote to memory of 3492 3760 windefender.exe cmd.exe PID 3492 wrote to memory of 696 3492 cmd.exe sc.exe PID 3492 wrote to memory of 696 3492 cmd.exe sc.exe PID 3492 wrote to memory of 696 3492 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe"C:\Users\Admin\AppData\Local\Temp\d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe"C:\Users\Admin\AppData\Local\Temp\d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzhahmay.ynw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e6815db12190874eee98fb0a1246c5eb
SHA139c77f6c1f8c66c3a30b2f83b39bb1c1a37e166c
SHA2562e7bd90783cbc3a9fe9ede0ec5cbc6ca412fda923be5b6cb0a1a537ed293ff2d
SHA51203330433f5d707f996a4037bb06850bc043e6641c9bab95af1edcedf43e447e00ac83f7d0c70d2f072ad066e87ba2dddf4384812d26ff8c2f42f2d7ef771d285
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD58a0ca278a68ab9e3b1f7eaa368c69e07
SHA1a485223d28f45964d11ba11b92f340312d17be7e
SHA256c18514fbfcdf408a0621fc2968f3ea65cf604ae8a3a1a94e5af85bb2ada4baec
SHA512994d298d5d814a0f9b34ff4d2bb42a47c0f12a07e13f531eb30ce4bc7b3525f822ab06d791f71a7072f4e244ed5afd5b7c0c4f44dedec90dda30138137a5f190
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5bf92ca5057970641702bb98ed9676c06
SHA1a2494229f180dba98325c16531a6ac676fb7c457
SHA2560f22edd02d888c9245ec3d828199a49ebbd6f3d8358b8fe727bdb0653ca89d27
SHA5129d72ae6e78d9764d57e984c958c24fee2a0df06fe04e35c644e232622dd23cfabcb7db7c2480277dd201b424a5e9c45d6b93ad5275382773d241e2080dd16758
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5fe772550abcfe574768827dbfb771264
SHA1593f44e0cdc399bb805e4e7554a3173639697aea
SHA25690091083290974337e19a03773a04bfb225769fe4f2ae74575ecc2db3e234258
SHA5124e1cf5f8bc671162ed003c49d6938999f1f720e6ecb356336650fb238aaa1f92a9193c027317f3118233912456ee30a1206d9685b9fabbd1d066fb0404ebd368
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD543039ab692e4871b5e08335e20b7365e
SHA1bfb6aebd87a9f1927efc332b5e0b6cbc3973f76a
SHA25637df35a8f5f5aa3dae4fafaadf40f79a016d159475f8f27870bc8828fccbeb37
SHA512ea2609e0081edf786a2af3c3223d20f7324f97bc6ad14d64a396025e7b357b46ce0bb2af93557c3d99c4a43446f14f7e448497c6a60cb91128b21db64d5d2f87
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD599ad1872c94b0cb2b5090562786d3a88
SHA1298edaaecfa7ac1e286fa8bef4b3bb455d2aa981
SHA256d4d6f94a0bfa8daee7e8f8efe4f36e9f3cc988d23b26daf9cf6ca01c88ef7afe
SHA5126db0c23f1326bb82e528608e3951ff1e237bbde39ccd18db1d350e021b05e96dbc6eb3f30042c64513c86d0658c30092c401e8c61e1b97f38a4e370e05663725
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1608-68-0x00000000703C0000-0x000000007040C000-memory.dmpFilesize
304KB
-
memory/1608-79-0x0000000006E00000-0x0000000006EA4000-memory.dmpFilesize
656KB
-
memory/1608-82-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/1608-81-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/1608-80-0x000000007F080000-0x000000007F090000-memory.dmpFilesize
64KB
-
memory/1608-83-0x0000000007120000-0x0000000007131000-memory.dmpFilesize
68KB
-
memory/1608-69-0x0000000070540000-0x0000000070897000-memory.dmpFilesize
3.3MB
-
memory/1608-67-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/1608-66-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/1608-65-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/1608-64-0x0000000005750000-0x0000000005AA7000-memory.dmpFilesize
3.3MB
-
memory/1608-84-0x0000000007170000-0x0000000007185000-memory.dmpFilesize
84KB
-
memory/1608-87-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/2384-115-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/2384-103-0x00000000703C0000-0x000000007040C000-memory.dmpFilesize
304KB
-
memory/2384-102-0x000000007F3D0000-0x000000007F3E0000-memory.dmpFilesize
64KB
-
memory/2384-91-0x0000000002FD0000-0x0000000002FE0000-memory.dmpFilesize
64KB
-
memory/2384-92-0x0000000005DE0000-0x0000000006137000-memory.dmpFilesize
3.3MB
-
memory/2384-89-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/2384-104-0x0000000070610000-0x0000000070967000-memory.dmpFilesize
3.3MB
-
memory/2384-90-0x0000000002FD0000-0x0000000002FE0000-memory.dmpFilesize
64KB
-
memory/2412-275-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-269-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-266-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-287-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-284-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-272-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-245-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-278-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-250-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-263-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-257-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-281-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2412-260-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/3760-254-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4692-258-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4692-264-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4748-52-0x0000000003C30000-0x0000000004031000-memory.dmpFilesize
4.0MB
-
memory/4748-53-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4748-113-0x0000000003C30000-0x0000000004031000-memory.dmpFilesize
4.0MB
-
memory/4748-147-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4972-78-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4972-55-0x00000000040A0000-0x000000000498B000-memory.dmpFilesize
8.9MB
-
memory/4972-54-0x0000000003CA0000-0x000000000409A000-memory.dmpFilesize
4.0MB
-
memory/4972-3-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4972-1-0x0000000003CA0000-0x000000000409A000-memory.dmpFilesize
4.0MB
-
memory/4972-2-0x00000000040A0000-0x000000000498B000-memory.dmpFilesize
8.9MB
-
memory/5044-38-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/5044-20-0x00000000056F0000-0x0000000005A47000-memory.dmpFilesize
3.3MB
-
memory/5044-47-0x0000000007310000-0x0000000007318000-memory.dmpFilesize
32KB
-
memory/5044-46-0x00000000072F0000-0x000000000730A000-memory.dmpFilesize
104KB
-
memory/5044-45-0x00000000072A0000-0x00000000072B5000-memory.dmpFilesize
84KB
-
memory/5044-4-0x00000000047B0000-0x00000000047E6000-memory.dmpFilesize
216KB
-
memory/5044-5-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/5044-6-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/5044-44-0x0000000007290000-0x000000000729E000-memory.dmpFilesize
56KB
-
memory/5044-7-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/5044-8-0x0000000004E20000-0x000000000544A000-memory.dmpFilesize
6.2MB
-
memory/5044-43-0x0000000007240000-0x0000000007251000-memory.dmpFilesize
68KB
-
memory/5044-42-0x0000000007330000-0x00000000073C6000-memory.dmpFilesize
600KB
-
memory/5044-41-0x0000000007220000-0x000000000722A000-memory.dmpFilesize
40KB
-
memory/5044-39-0x0000000007820000-0x0000000007E9A000-memory.dmpFilesize
6.5MB
-
memory/5044-40-0x00000000071E0000-0x00000000071FA000-memory.dmpFilesize
104KB
-
memory/5044-37-0x00000000070B0000-0x0000000007154000-memory.dmpFilesize
656KB
-
memory/5044-36-0x0000000007090000-0x00000000070AE000-memory.dmpFilesize
120KB
-
memory/5044-26-0x00000000703C0000-0x000000007040C000-memory.dmpFilesize
304KB
-
memory/5044-27-0x0000000070570000-0x00000000708C7000-memory.dmpFilesize
3.3MB
-
memory/5044-24-0x000000007FDF0000-0x000000007FE00000-memory.dmpFilesize
64KB
-
memory/5044-25-0x0000000007050000-0x0000000007084000-memory.dmpFilesize
208KB
-
memory/5044-23-0x0000000006BF0000-0x0000000006C36000-memory.dmpFilesize
280KB
-
memory/5044-22-0x0000000005CD0000-0x0000000005D1C000-memory.dmpFilesize
304KB
-
memory/5044-21-0x0000000005C10000-0x0000000005C2E000-memory.dmpFilesize
120KB
-
memory/5044-50-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/5044-11-0x00000000055C0000-0x0000000005626000-memory.dmpFilesize
408KB
-
memory/5044-10-0x0000000005550000-0x00000000055B6000-memory.dmpFilesize
408KB
-
memory/5044-9-0x0000000004D60000-0x0000000004D82000-memory.dmpFilesize
136KB
-
memory/5092-130-0x0000000070540000-0x0000000070897000-memory.dmpFilesize
3.3MB
-
memory/5092-129-0x00000000703C0000-0x000000007040C000-memory.dmpFilesize
304KB
-
memory/5092-116-0x0000000074150000-0x0000000074901000-memory.dmpFilesize
7.7MB
-
memory/5092-118-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB
-
memory/5092-117-0x0000000004C20000-0x0000000004C30000-memory.dmpFilesize
64KB