Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 16:13
Static task
static1
General
-
Target
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe
-
Size
4.2MB
-
MD5
7269a1678bcd9b19944480d1a42d3af0
-
SHA1
33a7708f322815fdf30732dc45f3fc94afbfb43f
-
SHA256
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895
-
SHA512
eecefa1ed992b27a005cf5a86e8ed60289ca5ef09cb255b0eabcd4e031f9f1b345104740952f0c708fafdd0ea9e7f17ff79bda4f49042250d8421b4da3e0e7fd
-
SSDEEP
98304:Q/5S+b1Z/p6oQSInErfLJd2o/OVdeUy7NtwW:QBnTENnKJ0ZVk1BtwW
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4480-134-0x0000000005290000-0x0000000005B7B000-memory.dmp family_glupteba behavioral1/memory/4480-170-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/4480-191-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/380-220-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/380-265-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-268-0x0000000005600000-0x0000000005EEB000-memory.dmp family_glupteba behavioral1/memory/2032-295-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-348-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-356-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-366-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-369-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-372-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-375-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-378-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-381-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-384-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2032-394-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 2032 csrss.exe 3192 injector.exe 3436 windefender.exe 4620 windefender.exe 2792 f801950a962ddba14caaa44bf084b55c.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/3436-360-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral1/memory/3436-363-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4620-365-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4620-377-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4620-385-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral1/memory/2792-392-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral1/memory/4620-393-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe -
Drops file in Windows directory 4 IoCs
Processes:
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2180 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1192 schtasks.exe 4464 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exed966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exed966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exepowershell.exed966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4380 powershell.exe 4380 powershell.exe 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 4204 powershell.exe 4204 powershell.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe 3952 powershell.exe 3952 powershell.exe 5084 powershell.exe 5084 powershell.exe 1608 powershell.exe 1608 powershell.exe 4904 powershell.exe 4904 powershell.exe 4364 powershell.exe 4364 powershell.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 2032 csrss.exe 2032 csrss.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 2032 csrss.exe 2032 csrss.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 2032 csrss.exe 2032 csrss.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe 3192 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exed966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Token: SeImpersonatePrivilege 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe Token: SeDebugPrivilege 4204 powershell.exe Token: SeDebugPrivilege 3952 powershell.exe Token: SeDebugPrivilege 5084 powershell.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 4904 powershell.exe Token: SeDebugPrivilege 4364 powershell.exe Token: SeSystemEnvironmentPrivilege 2032 csrss.exe Token: SeSecurityPrivilege 2180 sc.exe Token: SeSecurityPrivilege 2180 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exed966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4480 wrote to memory of 4380 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 4480 wrote to memory of 4380 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 4480 wrote to memory of 4380 4480 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 4204 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 4204 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 4204 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 4436 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe cmd.exe PID 380 wrote to memory of 4436 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe cmd.exe PID 4436 wrote to memory of 2900 4436 cmd.exe netsh.exe PID 4436 wrote to memory of 2900 4436 cmd.exe netsh.exe PID 380 wrote to memory of 3952 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 3952 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 3952 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 5084 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 5084 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 5084 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe powershell.exe PID 380 wrote to memory of 2032 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe csrss.exe PID 380 wrote to memory of 2032 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe csrss.exe PID 380 wrote to memory of 2032 380 d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe csrss.exe PID 2032 wrote to memory of 1608 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 1608 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 1608 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4904 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4904 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4904 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4364 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4364 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 4364 2032 csrss.exe powershell.exe PID 2032 wrote to memory of 3192 2032 csrss.exe injector.exe PID 2032 wrote to memory of 3192 2032 csrss.exe injector.exe PID 3436 wrote to memory of 3772 3436 windefender.exe cmd.exe PID 3436 wrote to memory of 3772 3436 windefender.exe cmd.exe PID 3436 wrote to memory of 3772 3436 windefender.exe cmd.exe PID 3772 wrote to memory of 2180 3772 cmd.exe sc.exe PID 3772 wrote to memory of 2180 3772 cmd.exe sc.exe PID 3772 wrote to memory of 2180 3772 cmd.exe sc.exe PID 2032 wrote to memory of 2792 2032 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 2032 wrote to memory of 2792 2032 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 2032 wrote to memory of 2792 2032 csrss.exe f801950a962ddba14caaa44bf084b55c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe"C:\Users\Admin\AppData\Local\Temp\d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe"C:\Users\Admin\AppData\Local\Temp\d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2hcui0j.3v3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5fec200ee1b9d9eb0c16b1fd7d1185975
SHA1af2ccfa8fe522b832c2a47be3ec987afb8aa82ef
SHA256af21eb158e874e9434bcf308375d7673bf0be8182717dd7efad0f894b196ea87
SHA512d52861db6c2c4bb2beb4e1d2fe4cf4f0a970f91a907124d01ad431e18ef57ddee00f0ad099d6b84fa129272ba623dabb6bd3a07e98e41dcf47fb6ac2a18a09ea
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5044b56a35d8c25466270f0a7e6b0b6be
SHA1300de82a883ff7fde5d64dc283f6267118c14846
SHA2563b8fb2313a414a5be6a159dc67d2d7ddf4bd51ee43b565980be44235e70898f9
SHA5128540a31822a83f3fe5e9e2d7b9a82721d563a9f29b993131fa998a6447ff36452bfa0c9ed25ca6a18f4fb0ee816eefa5a4e76041710ffe7293ea00b1e9c3c4c3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a174925550c59787fdd555cf10e1ded5
SHA1eea997879418f25872ea893660f2cc34dc34f9ab
SHA256be43bcb6d6fb00535de3cc27ffef62a8235cb5bf01da081519605c51bdd34cc1
SHA512dd970c2dc9a278191d0f73d4086b7269cf1e1a8af10b3609a8002fc17b9e3a8f5a1b5e0806892f66a2756ed462e1ae3f57391e87d060a0a37ce536108aae77e0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5da6091fe12d303086b32be9f16885c2f
SHA1e9330bd24fa05f0309837fbe359cdf360c8e4c0d
SHA2568e85cf385514b07ef80407a487a89bd68199756c91db4895f1a5246c51be9a2a
SHA512da01da9b85ff6c0c9c40c97cf21d853730eccb921f75d2dfdd3424c3523f938a73cf6e492e2d512376dac5b8d7381cfdc6638dbbe9e316de9f02bc22a450ba78
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f86b39f9fa63d050a4b31d5f9e51d91e
SHA19a65636e819249498707ad86f6523d1c063ceafb
SHA25633384ea658f76fc92214b7ccc95acf1dda7d18fa8d89bcd5955dce71051714b2
SHA512b4f1e82cd4479aa83bd97d0b27cae64423b862891f7fa31c0fa0acde709a3ada7570437f9a8dc41aad586fbbc00553e13cf2a9e2db26e7ecccf9e8c2c812f647
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD57269a1678bcd9b19944480d1a42d3af0
SHA133a7708f322815fdf30732dc45f3fc94afbfb43f
SHA256d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895
SHA512eecefa1ed992b27a005cf5a86e8ed60289ca5ef09cb255b0eabcd4e031f9f1b345104740952f0c708fafdd0ea9e7f17ff79bda4f49042250d8421b4da3e0e7fd
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD57269a1678bcd9b19944480d1a42d3af0
SHA133a7708f322815fdf30732dc45f3fc94afbfb43f
SHA256d966ce5caba50f1d0404202cfec1b2180590376ee21f833546ce4ceca309d895
SHA512eecefa1ed992b27a005cf5a86e8ed60289ca5ef09cb255b0eabcd4e031f9f1b345104740952f0c708fafdd0ea9e7f17ff79bda4f49042250d8421b4da3e0e7fd
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/380-265-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/380-220-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/1608-282-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/1608-284-0x0000000070CC0000-0x0000000071014000-memory.dmpFilesize
3.3MB
-
memory/1608-280-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/1608-283-0x000000007FD00000-0x000000007FD10000-memory.dmpFilesize
64KB
-
memory/1608-281-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/2032-375-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-378-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-268-0x0000000005600000-0x0000000005EEB000-memory.dmpFilesize
8.9MB
-
memory/2032-356-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-394-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-384-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-366-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-369-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-295-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-372-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-348-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2032-381-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2792-392-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/3436-363-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3436-360-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3952-233-0x000000007F310000-0x000000007F320000-memory.dmpFilesize
64KB
-
memory/3952-213-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/3952-232-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/3952-221-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/3952-222-0x00000000712E0000-0x0000000071634000-memory.dmpFilesize
3.3MB
-
memory/3952-214-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/4204-193-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/4204-204-0x000000007F680000-0x000000007F690000-memory.dmpFilesize
64KB
-
memory/4204-194-0x0000000070CE0000-0x0000000071034000-memory.dmpFilesize
3.3MB
-
memory/4204-192-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/4204-181-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/4204-180-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/4364-333-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4364-334-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4364-335-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4364-337-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/4364-336-0x000000007F370000-0x000000007F380000-memory.dmpFilesize
64KB
-
memory/4364-338-0x00000000711F0000-0x0000000071544000-memory.dmpFilesize
3.3MB
-
memory/4380-175-0x0000000007890000-0x00000000078AA000-memory.dmpFilesize
104KB
-
memory/4380-151-0x0000000006070000-0x000000000608E000-memory.dmpFilesize
120KB
-
memory/4380-135-0x0000000004A50000-0x0000000004A86000-memory.dmpFilesize
216KB
-
memory/4380-136-0x0000000005140000-0x0000000005768000-memory.dmpFilesize
6.2MB
-
memory/4380-137-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4380-138-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4380-139-0x0000000005770000-0x0000000005792000-memory.dmpFilesize
136KB
-
memory/4380-140-0x0000000005890000-0x00000000058F6000-memory.dmpFilesize
408KB
-
memory/4380-141-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/4380-152-0x0000000006620000-0x0000000006664000-memory.dmpFilesize
272KB
-
memory/4380-153-0x00000000073A0000-0x0000000007416000-memory.dmpFilesize
472KB
-
memory/4380-154-0x0000000007AA0000-0x000000000811A000-memory.dmpFilesize
6.5MB
-
memory/4380-155-0x0000000007440000-0x000000000745A000-memory.dmpFilesize
104KB
-
memory/4380-156-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4380-176-0x00000000077E0000-0x00000000077E8000-memory.dmpFilesize
32KB
-
memory/4380-157-0x0000000007600000-0x0000000007632000-memory.dmpFilesize
200KB
-
memory/4380-174-0x00000000077A0000-0x00000000077AE000-memory.dmpFilesize
56KB
-
memory/4380-173-0x00000000077F0000-0x0000000007886000-memory.dmpFilesize
600KB
-
memory/4380-172-0x000000007FDF0000-0x000000007FE00000-memory.dmpFilesize
64KB
-
memory/4380-158-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/4380-171-0x0000000007730000-0x000000000773A000-memory.dmpFilesize
40KB
-
memory/4380-169-0x00000000075E0000-0x00000000075FE000-memory.dmpFilesize
120KB
-
memory/4380-159-0x0000000070F10000-0x0000000071264000-memory.dmpFilesize
3.3MB
-
memory/4480-170-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/4480-134-0x0000000005290000-0x0000000005B7B000-memory.dmpFilesize
8.9MB
-
memory/4480-191-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/4620-377-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4620-365-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4620-393-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4620-385-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4904-296-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/4904-320-0x000000007FC80000-0x000000007FC90000-memory.dmpFilesize
64KB
-
memory/4904-310-0x0000000071210000-0x0000000071564000-memory.dmpFilesize
3.3MB
-
memory/4904-309-0x0000000070A60000-0x0000000070AAC000-memory.dmpFilesize
304KB
-
memory/4904-308-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/4904-297-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/5084-260-0x000000007FD30000-0x000000007FD40000-memory.dmpFilesize
64KB
-
memory/5084-248-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/5084-236-0x00000000048A0000-0x00000000048B0000-memory.dmpFilesize
64KB
-
memory/5084-249-0x00000000712C0000-0x0000000071614000-memory.dmpFilesize
3.3MB
-
memory/5084-235-0x00000000048A0000-0x00000000048B0000-memory.dmpFilesize
64KB
-
memory/5084-259-0x00000000048A0000-0x00000000048B0000-memory.dmpFilesize
64KB