Analysis
-
max time kernel
301s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
12-06-2023 03:00
Static task
static1
Behavioral task
behavioral1
Sample
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe
Resource
win7-20230220-en
General
-
Target
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe
-
Size
4.1MB
-
MD5
d82f58a3a66392e427af0c1ed193a436
-
SHA1
9400a04b6723f3c338dc783ee1f042c38b0ef7bb
-
SHA256
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f
-
SHA512
8fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb
-
SSDEEP
98304:pXhDTlaeN7+WIQy2uZFBRMNdD+S1O82s2jA3qPjPLFjEut3uNt+euu2TO+N8:pXXN7DvuZ5M7+v4AjLFgNt+euq
Malware Config
Signatures
-
Glupteba payload 33 IoCs
Processes:
resource yara_rule behavioral2/memory/2008-122-0x00000000041C0000-0x0000000004AAB000-memory.dmp family_glupteba behavioral2/memory/2008-154-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2008-186-0x00000000041C0000-0x0000000004AAB000-memory.dmp family_glupteba behavioral2/memory/2008-410-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2008-420-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/1012-655-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/1012-913-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/1012-1153-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1156-0x0000000004400000-0x0000000004CEB000-memory.dmp family_glupteba behavioral2/memory/2588-1187-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1467-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1655-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1656-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1657-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1658-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1659-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1660-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1661-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1662-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1663-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1664-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1665-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1666-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1667-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1668-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1669-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1670-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1671-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1672-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1673-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1674-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1675-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba behavioral2/memory/2588-1676-0x0000000000400000-0x0000000001EB5000-memory.dmp family_glupteba -
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 2588 csrss.exe 1136 injector.exe -
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe = "0" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe -
Drops file in Windows directory 2 IoCs
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exedescription ioc process File opened for modification C:\Windows\rss 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe File created C:\Windows\rss\csrss.exe 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1572 schtasks.exe 4688 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exepowershell.exe8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 4772 powershell.exe 4772 powershell.exe 4772 powershell.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe 4904 powershell.exe 4904 powershell.exe 4904 powershell.exe 1708 powershell.exe 1708 powershell.exe 1708 powershell.exe 1348 powershell.exe 1348 powershell.exe 1348 powershell.exe 692 powershell.exe 692 powershell.exe 692 powershell.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 2588 csrss.exe 2588 csrss.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 2588 csrss.exe 2588 csrss.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe 1136 injector.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exe8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Token: SeImpersonatePrivilege 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeDebugPrivilege 4904 powershell.exe Token: SeDebugPrivilege 1708 powershell.exe Token: SeDebugPrivilege 1348 powershell.exe Token: SeDebugPrivilege 692 powershell.exe Token: SeSystemEnvironmentPrivilege 2588 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.execmd.execsrss.exedescription pid process target process PID 2008 wrote to memory of 2852 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 2008 wrote to memory of 2852 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 2008 wrote to memory of 2852 2008 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 4772 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 4772 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 4772 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 3128 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe cmd.exe PID 1012 wrote to memory of 3128 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe cmd.exe PID 3128 wrote to memory of 3144 3128 cmd.exe netsh.exe PID 3128 wrote to memory of 3144 3128 cmd.exe netsh.exe PID 1012 wrote to memory of 4904 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 4904 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 4904 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 1708 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 1708 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 1708 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe powershell.exe PID 1012 wrote to memory of 2588 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe csrss.exe PID 1012 wrote to memory of 2588 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe csrss.exe PID 1012 wrote to memory of 2588 1012 8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe csrss.exe PID 2588 wrote to memory of 1372 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1372 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1372 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1348 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1348 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1348 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 692 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 692 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 692 2588 csrss.exe powershell.exe PID 2588 wrote to memory of 1136 2588 csrss.exe injector.exe PID 2588 wrote to memory of 1136 2588 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe"C:\Users\Admin\AppData\Local\Temp\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe"C:\Users\Admin\AppData\Local\Temp\8b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgk0w4cp.mfr.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD56c1d4ef0c6c7ec76478da3c8db6ddcc7
SHA1f0125f5b63449dac742e0d95983dcf516a62ceb0
SHA2560178d065ac2d8409708cf25704987d8c3568784cfa1ba26194aaac9431ad9788
SHA512ff1b8f92a1c63285c0d65b2ae069a02bf4302c089692d4e4fcde256a4382de5e8d9d16437cb29b01631bca4760d919d7a5940007ed2defd9c9aba0ecef091a35
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5f1dacef4a9d689c132fd4f5bae8b2cd8
SHA1a8aa9848c79582377facd9414ba59f513e0378fa
SHA2565c1ac9e28c75640919d46e0e58770d5be7712965b13a037c001bb242b4f39e72
SHA512fc4ec503cf21491148011c1040e4f4d451a9f482de2353901f2f80b79a1e06f5ddea43293a3af8f220b698d559c4546b70347afedff70bdbbf63dc3d3c7f2b62
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5527d0a460d848355696c755dea333173
SHA163ef6bc33b54255a5ef0e6b6dff83b0cf2e22f4e
SHA256fc22deb7a9efa87da93dfe8e6b219677bf32130562350bc1bed7eced8259cd86
SHA512825d10e74ef34558def5287f248d9c739bd2f75b1fe43a8a04a4cc732c98c8d57a1430f89a2684c24a5b6e2cdf6ecca72cf7e79bf2d8f56f7af88087035c1167
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5d762561f927500ced88888b2c8101e6e
SHA17734994b4cbff8019dd91e8f8f71a946ec398db2
SHA256269e9c7d483e69e8ff06fb6c1e7657375c2dd872f06cbeb20a598b4345ef0480
SHA5121f08a8f1f5ccd8dd023167dace834a487f0307319f156769df6f21994f8075b1253474acac5e50e8c95b2b340aaa3baffce3575d5a07d7533fa278bb601cc3ea
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5d82f58a3a66392e427af0c1ed193a436
SHA19400a04b6723f3c338dc783ee1f042c38b0ef7bb
SHA2568b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f
SHA5128fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5d82f58a3a66392e427af0c1ed193a436
SHA19400a04b6723f3c338dc783ee1f042c38b0ef7bb
SHA2568b0bc6d4b66528046bbb615a4749d3f8de40587632fc98e16264d39644f2839f
SHA5128fd988b26e6c15bb35820ee880fc910bd765d7a7cd0776c370133a236ce9b1f4d558f922efb538a9e98c5c5d5c3a49a0cf4df59b7ea1383152cb15b824913fdb
-
memory/692-1474-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/692-1409-0x00000000081D0000-0x0000000008520000-memory.dmpFilesize
3.3MB
-
memory/692-1411-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/692-1412-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/692-1472-0x000000007F1A0000-0x000000007F1B0000-memory.dmpFilesize
64KB
-
memory/1012-1153-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/1012-655-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/1012-913-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/1348-1167-0x0000000006E00000-0x0000000006E10000-memory.dmpFilesize
64KB
-
memory/1348-1164-0x0000000007DB0000-0x0000000008100000-memory.dmpFilesize
3.3MB
-
memory/1348-1166-0x0000000006E00000-0x0000000006E10000-memory.dmpFilesize
64KB
-
memory/1348-1168-0x0000000008410000-0x000000000845B000-memory.dmpFilesize
300KB
-
memory/1348-1192-0x0000000009810000-0x00000000098B5000-memory.dmpFilesize
660KB
-
memory/1348-1193-0x000000007F0A0000-0x000000007F0B0000-memory.dmpFilesize
64KB
-
memory/1348-1194-0x0000000006E00000-0x0000000006E10000-memory.dmpFilesize
64KB
-
memory/1708-932-0x000000007EDC0000-0x000000007EDD0000-memory.dmpFilesize
64KB
-
memory/1708-911-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/1708-945-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/1708-910-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/2008-154-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2008-186-0x00000000041C0000-0x0000000004AAB000-memory.dmpFilesize
8.9MB
-
memory/2008-122-0x00000000041C0000-0x0000000004AAB000-memory.dmpFilesize
8.9MB
-
memory/2008-420-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2008-410-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1670-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1662-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1668-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1667-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1666-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1665-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1467-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1671-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1672-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1664-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1673-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1674-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1663-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1669-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1661-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1156-0x0000000004400000-0x0000000004CEB000-memory.dmpFilesize
8.9MB
-
memory/2588-1660-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1659-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1675-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1658-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1676-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1657-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1187-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1656-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2588-1655-0x0000000000400000-0x0000000001EB5000-memory.dmpFilesize
26.7MB
-
memory/2852-271-0x0000000006630000-0x0000000006640000-memory.dmpFilesize
64KB
-
memory/2852-199-0x00000000099C0000-0x0000000009A65000-memory.dmpFilesize
660KB
-
memory/2852-130-0x0000000007520000-0x0000000007586000-memory.dmpFilesize
408KB
-
memory/2852-129-0x00000000072A0000-0x00000000072C2000-memory.dmpFilesize
136KB
-
memory/2852-132-0x0000000007640000-0x0000000007990000-memory.dmpFilesize
3.3MB
-
memory/2852-128-0x0000000006630000-0x0000000006640000-memory.dmpFilesize
64KB
-
memory/2852-126-0x0000000006630000-0x0000000006640000-memory.dmpFilesize
64KB
-
memory/2852-127-0x0000000006C70000-0x0000000007298000-memory.dmpFilesize
6.2MB
-
memory/2852-125-0x0000000006540000-0x0000000006576000-memory.dmpFilesize
216KB
-
memory/2852-133-0x0000000007A00000-0x0000000007A1C000-memory.dmpFilesize
112KB
-
memory/2852-134-0x0000000007F40000-0x0000000007F8B000-memory.dmpFilesize
300KB
-
memory/2852-153-0x0000000008A80000-0x0000000008ABC000-memory.dmpFilesize
240KB
-
memory/2852-185-0x0000000008B40000-0x0000000008BB6000-memory.dmpFilesize
472KB
-
memory/2852-193-0x0000000009980000-0x00000000099B3000-memory.dmpFilesize
204KB
-
memory/2852-194-0x0000000009960000-0x000000000997E000-memory.dmpFilesize
120KB
-
memory/2852-131-0x0000000007340000-0x00000000073A6000-memory.dmpFilesize
408KB
-
memory/2852-200-0x000000007EFF0000-0x000000007F000000-memory.dmpFilesize
64KB
-
memory/2852-201-0x0000000009B90000-0x0000000009C24000-memory.dmpFilesize
592KB
-
memory/2852-205-0x0000000006630000-0x0000000006640000-memory.dmpFilesize
64KB
-
memory/2852-401-0x0000000007FB0000-0x0000000007FB8000-memory.dmpFilesize
32KB
-
memory/2852-396-0x0000000009550000-0x000000000956A000-memory.dmpFilesize
104KB
-
memory/4772-518-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4772-449-0x000000007EBC0000-0x000000007EBD0000-memory.dmpFilesize
64KB
-
memory/4772-448-0x0000000009300000-0x00000000093A5000-memory.dmpFilesize
660KB
-
memory/4772-425-0x0000000007DC0000-0x0000000007E0B000-memory.dmpFilesize
300KB
-
memory/4772-424-0x00000000079F0000-0x0000000007D40000-memory.dmpFilesize
3.3MB
-
memory/4904-670-0x0000000006670000-0x0000000006680000-memory.dmpFilesize
64KB
-
memory/4904-671-0x0000000006670000-0x0000000006680000-memory.dmpFilesize
64KB
-
memory/4904-729-0x0000000006670000-0x0000000006680000-memory.dmpFilesize
64KB
-
memory/4904-668-0x0000000007480000-0x00000000077D0000-memory.dmpFilesize
3.3MB
-
memory/4904-727-0x000000007EAF0000-0x000000007EB00000-memory.dmpFilesize
64KB