Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 12:00
Static task
static1
Behavioral task
behavioral1
Sample
3eef203fb515bda85f514e168abb5973.exe
Resource
win7-20230621-en
General
-
Target
3eef203fb515bda85f514e168abb5973.exe
-
Size
4.1MB
-
MD5
451af59f1dc7bf09eaad8c27aab0a8fe
-
SHA1
a1e5d215d9e45937697d72e14d33476c6af4705c
-
SHA256
2273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606
-
SHA512
39b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d
-
SSDEEP
98304:2RRu7JlHIqCfORsvc+0by6a+tN8vWZ2P1VDRDL5tTNz7W:2RQtlo9WJCqN8vgI11zC
Malware Config
Signatures
-
Glupteba payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/4744-134-0x0000000003100000-0x00000000039EB000-memory.dmp family_glupteba behavioral2/memory/4744-158-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4744-206-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/3516-234-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/3516-263-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-343-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-358-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-366-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-371-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-375-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-378-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-381-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-383-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5012-393-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 5012 csrss.exe 1600 injector.exe 348 windefender.exe 712 windefender.exe 4008 f801950a962ddba14caaa44bf084b55c.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/348-355-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/348-356-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/712-357-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/712-362-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/712-377-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/712-384-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral2/memory/4008-391-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral2/memory/712-392-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4008-395-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral2/memory/4008-397-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3eef203fb515bda85f514e168abb5973.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 15 IoCs
Processes:
svchost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8D4A8CAB-FE72-4A84-A944-9652BC04D45B}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C3813E2A-7596-4686-B5C9-F1333EE28D3A}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1065EBD4-2BEE-4FA7-AF41-02BE7E6FC432}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{23EC6FBD-33BA-4F77-9C38-E4C6E7B3F56A}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FE73EC76-530F-40A3-BD6D-D20E39EF93F3}.catalogItem svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{663B3106-B1A4-4E11-8DC6-E83B1341D2A3}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{49D32043-1CF4-490E-8A6B-25736AEA182F}.catalogItem svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F306250B-5CC0-4442-91DC-FE978327A4AB}.catalogItem svchost.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
3eef203fb515bda85f514e168abb5973.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 3eef203fb515bda85f514e168abb5973.exe -
Drops file in Windows directory 4 IoCs
Processes:
3eef203fb515bda85f514e168abb5973.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 3eef203fb515bda85f514e168abb5973.exe File created C:\Windows\rss\csrss.exe 3eef203fb515bda85f514e168abb5973.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2324 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3956 schtasks.exe 1632 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exewindefender.exe3eef203fb515bda85f514e168abb5973.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 3eef203fb515bda85f514e168abb5973.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 3eef203fb515bda85f514e168abb5973.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" 3eef203fb515bda85f514e168abb5973.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe3eef203fb515bda85f514e168abb5973.exepowershell.exe3eef203fb515bda85f514e168abb5973.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4332 powershell.exe 4332 powershell.exe 4744 3eef203fb515bda85f514e168abb5973.exe 4744 3eef203fb515bda85f514e168abb5973.exe 4324 powershell.exe 4324 powershell.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 3516 3eef203fb515bda85f514e168abb5973.exe 4124 powershell.exe 4124 powershell.exe 1764 powershell.exe 1764 powershell.exe 4848 powershell.exe 4848 powershell.exe 5064 powershell.exe 5064 powershell.exe 1276 powershell.exe 1276 powershell.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 5012 csrss.exe 5012 csrss.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 5012 csrss.exe 5012 csrss.exe 1600 injector.exe 1600 injector.exe 5012 csrss.exe 5012 csrss.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe 1600 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe3eef203fb515bda85f514e168abb5973.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4332 powershell.exe Token: SeDebugPrivilege 4744 3eef203fb515bda85f514e168abb5973.exe Token: SeImpersonatePrivilege 4744 3eef203fb515bda85f514e168abb5973.exe Token: SeDebugPrivilege 4324 powershell.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 5064 powershell.exe Token: SeDebugPrivilege 1276 powershell.exe Token: SeSystemEnvironmentPrivilege 5012 csrss.exe Token: SeSecurityPrivilege 2324 sc.exe Token: SeSecurityPrivilege 2324 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
3eef203fb515bda85f514e168abb5973.exe3eef203fb515bda85f514e168abb5973.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4744 wrote to memory of 4332 4744 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 4744 wrote to memory of 4332 4744 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 4744 wrote to memory of 4332 4744 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 4324 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 4324 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 4324 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 3532 3516 3eef203fb515bda85f514e168abb5973.exe cmd.exe PID 3516 wrote to memory of 3532 3516 3eef203fb515bda85f514e168abb5973.exe cmd.exe PID 3532 wrote to memory of 3524 3532 cmd.exe netsh.exe PID 3532 wrote to memory of 3524 3532 cmd.exe netsh.exe PID 3516 wrote to memory of 4124 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 4124 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 4124 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 1764 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 1764 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 1764 3516 3eef203fb515bda85f514e168abb5973.exe powershell.exe PID 3516 wrote to memory of 5012 3516 3eef203fb515bda85f514e168abb5973.exe csrss.exe PID 3516 wrote to memory of 5012 3516 3eef203fb515bda85f514e168abb5973.exe csrss.exe PID 3516 wrote to memory of 5012 3516 3eef203fb515bda85f514e168abb5973.exe csrss.exe PID 5012 wrote to memory of 4848 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 4848 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 4848 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 5064 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 5064 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 5064 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 1276 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 1276 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 1276 5012 csrss.exe powershell.exe PID 5012 wrote to memory of 1600 5012 csrss.exe injector.exe PID 5012 wrote to memory of 1600 5012 csrss.exe injector.exe PID 348 wrote to memory of 4248 348 windefender.exe cmd.exe PID 348 wrote to memory of 4248 348 windefender.exe cmd.exe PID 348 wrote to memory of 4248 348 windefender.exe cmd.exe PID 4248 wrote to memory of 2324 4248 cmd.exe sc.exe PID 4248 wrote to memory of 2324 4248 cmd.exe sc.exe PID 4248 wrote to memory of 2324 4248 cmd.exe sc.exe PID 5012 wrote to memory of 4008 5012 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 5012 wrote to memory of 4008 5012 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 5012 wrote to memory of 4008 5012 csrss.exe f801950a962ddba14caaa44bf084b55c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3eef203fb515bda85f514e168abb5973.exe"C:\Users\Admin\AppData\Local\Temp\3eef203fb515bda85f514e168abb5973.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3eef203fb515bda85f514e168abb5973.exe"C:\Users\Admin\AppData\Local\Temp\3eef203fb515bda85f514e168abb5973.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljs5d4vm.dbw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dllFilesize
99KB
MD509031a062610d77d685c9934318b4170
SHA1880f744184e7774f3d14c1bb857e21cc7fe89a6d
SHA256778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd
SHA5129a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a2a4fa7aab29356fdb4f99e514558627
SHA1c9f83a269de7aada8e18ec5c10723d17287c86b5
SHA2569c5eb966f408a57c9d5bb08e667144080f831b4fd2ae83e0f51956078dc45a95
SHA5121933baebaa41cebb4e57ee56559a4f2596b533ab158097e12656c6c7e8c062cae0c10c1760631307c4b0f5f7f7d82ecd4d821bfb69471f4b0a24ab62bca54010
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56c83005e94391796685debb91256085c
SHA1cfe1a842f510f8b44c0bd27af313b31af493ded9
SHA25621abdc219b509d0e983763ee759838b5d503c833e2cd8d3058364ab6727fc7dd
SHA512c3b2ba9b6783b47f78abc3c5091cc03325b3b0a45753f0c8825c7cd2fdf40f0c94e93246db28c1cdd30e981f9a1ec332830b8fa1d4671b4a583a9a4576d22833
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54dc5ab4490f3cd30e28df7229adf39c4
SHA12d0d5ac20d56159e2e8ce28d1c14fe3ddec60d60
SHA2569668db62348eba2f72da4a82e4acaf71a8c15958147524e569de0d05c4463d1d
SHA512952315f0eccae931922cb0a7dce2741899bbf48c28b34e1a46732207e942172d18705fab18e6f0ed2f219901c12b816bd667f425b914c76e30417755e8994214
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5303b0bdfb6f8baea4b85d9a911780b68
SHA160900d198963a0e3263b01710fa5ef99e3e2c217
SHA2561951f33faad25932a5028b4c028145aa15677ee757cbf80bb314197e75959a9d
SHA5124abb0cab475c6382afe86521bd5bc1d7d61ab62b5fe414ba9e738bf991449aafc165fb43820498b5d87706383614ae5595e4956a2c7afaa757f9da02b8a616f6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f3cefb44b4415e68bba07d3b04603cd6
SHA15f9f6481dcca714d09cd8bc46c9453b9d3b37c2b
SHA2568d116bb74c7f236af238378298c031deb91a999e9a101aa2e737d7b0d83c23c8
SHA5126cbc3b69f62c3e8d4b9df6e26666f3777e6e041deb869020b219fcb2856ee3dcdbd78a902a1eb83dbb20b8fa06da76ba5fd3631bfe0aad907c92d266db836624
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5451af59f1dc7bf09eaad8c27aab0a8fe
SHA1a1e5d215d9e45937697d72e14d33476c6af4705c
SHA2562273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606
SHA51239b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5451af59f1dc7bf09eaad8c27aab0a8fe
SHA1a1e5d215d9e45937697d72e14d33476c6af4705c
SHA2562273ad3c5739e3c75de32a37f690ccce141a76524c20cd773e267b6b93731606
SHA51239b70ffa5e0b56fc6b550d0d16d00aec809f366a5dc1027b418e3198ae86a950d07721ed749776f6b3d9ce5eeea3b24895bd58aee66daa2ba8a5b5176bf6d41d
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/348-355-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/348-356-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/712-357-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/712-362-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/712-377-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/712-384-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/712-392-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1276-329-0x0000000000F70000-0x0000000000F80000-memory.dmpFilesize
64KB
-
memory/1276-330-0x000000007FBB0000-0x000000007FBC0000-memory.dmpFilesize
64KB
-
memory/1276-318-0x0000000000F70000-0x0000000000F80000-memory.dmpFilesize
64KB
-
memory/1276-331-0x0000000070860000-0x00000000708AC000-memory.dmpFilesize
304KB
-
memory/1276-332-0x0000000070FF0000-0x0000000071344000-memory.dmpFilesize
3.3MB
-
memory/1764-248-0x0000000070AC0000-0x0000000070E14000-memory.dmpFilesize
3.3MB
-
memory/1764-258-0x000000007F9D0000-0x000000007F9E0000-memory.dmpFilesize
64KB
-
memory/1764-247-0x0000000070940000-0x000000007098C000-memory.dmpFilesize
304KB
-
memory/1764-245-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/1764-246-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/3516-263-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/3516-234-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4008-397-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4008-395-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4008-391-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4124-231-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/4124-221-0x0000000070AC0000-0x0000000070E14000-memory.dmpFilesize
3.3MB
-
memory/4124-232-0x000000007FAB0000-0x000000007FAC0000-memory.dmpFilesize
64KB
-
memory/4124-220-0x0000000070940000-0x000000007098C000-memory.dmpFilesize
304KB
-
memory/4124-219-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/4124-218-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/4324-189-0x0000000002B50000-0x0000000002B60000-memory.dmpFilesize
64KB
-
memory/4324-190-0x0000000002B50000-0x0000000002B60000-memory.dmpFilesize
64KB
-
memory/4324-191-0x0000000002B50000-0x0000000002B60000-memory.dmpFilesize
64KB
-
memory/4324-192-0x0000000070940000-0x000000007098C000-memory.dmpFilesize
304KB
-
memory/4324-203-0x000000007F880000-0x000000007F890000-memory.dmpFilesize
64KB
-
memory/4324-193-0x00000000710C0000-0x0000000071414000-memory.dmpFilesize
3.3MB
-
memory/4332-157-0x0000000007080000-0x00000000070B2000-memory.dmpFilesize
200KB
-
memory/4332-171-0x0000000007060000-0x000000000707E000-memory.dmpFilesize
120KB
-
memory/4332-174-0x0000000007210000-0x000000000721E000-memory.dmpFilesize
56KB
-
memory/4332-138-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/4332-140-0x0000000005300000-0x0000000005366000-memory.dmpFilesize
408KB
-
memory/4332-141-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/4332-151-0x0000000005B10000-0x0000000005B2E000-memory.dmpFilesize
120KB
-
memory/4332-173-0x0000000007270000-0x0000000007306000-memory.dmpFilesize
600KB
-
memory/4332-175-0x0000000007310000-0x000000000732A000-memory.dmpFilesize
104KB
-
memory/4332-152-0x0000000006070000-0x00000000060B4000-memory.dmpFilesize
272KB
-
memory/4332-176-0x0000000007250000-0x0000000007258000-memory.dmpFilesize
32KB
-
memory/4332-135-0x0000000002520000-0x0000000002556000-memory.dmpFilesize
216KB
-
memory/4332-153-0x0000000006E40000-0x0000000006EB6000-memory.dmpFilesize
472KB
-
memory/4332-136-0x0000000004BE0000-0x0000000005208000-memory.dmpFilesize
6.2MB
-
memory/4332-172-0x00000000071B0000-0x00000000071BA000-memory.dmpFilesize
40KB
-
memory/4332-154-0x0000000007540000-0x0000000007BBA000-memory.dmpFilesize
6.5MB
-
memory/4332-161-0x0000000070AC0000-0x0000000070E14000-memory.dmpFilesize
3.3MB
-
memory/4332-160-0x000000007FCC0000-0x000000007FCD0000-memory.dmpFilesize
64KB
-
memory/4332-156-0x0000000006EC0000-0x0000000006EDA000-memory.dmpFilesize
104KB
-
memory/4332-139-0x0000000005260000-0x0000000005282000-memory.dmpFilesize
136KB
-
memory/4332-137-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/4332-159-0x0000000070940000-0x000000007098C000-memory.dmpFilesize
304KB
-
memory/4332-155-0x00000000024B0000-0x00000000024C0000-memory.dmpFilesize
64KB
-
memory/4744-158-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4744-133-0x0000000002D00000-0x00000000030F8000-memory.dmpFilesize
4.0MB
-
memory/4744-134-0x0000000003100000-0x00000000039EB000-memory.dmpFilesize
8.9MB
-
memory/4744-206-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4848-266-0x0000000002CC0000-0x0000000002CD0000-memory.dmpFilesize
64KB
-
memory/4848-281-0x00000000710C0000-0x0000000071414000-memory.dmpFilesize
3.3MB
-
memory/4848-278-0x0000000002CC0000-0x0000000002CD0000-memory.dmpFilesize
64KB
-
memory/4848-280-0x000000007F7A0000-0x000000007F7B0000-memory.dmpFilesize
64KB
-
memory/4848-279-0x0000000070940000-0x000000007098C000-memory.dmpFilesize
304KB
-
memory/5012-358-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-343-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-371-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-378-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-381-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-383-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-366-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-375-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5012-393-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5064-315-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/5064-305-0x0000000070FF0000-0x0000000071344000-memory.dmpFilesize
3.3MB
-
memory/5064-316-0x000000007F370000-0x000000007F380000-memory.dmpFilesize
64KB
-
memory/5064-304-0x0000000070860000-0x00000000708AC000-memory.dmpFilesize
304KB
-
memory/5064-303-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/5064-302-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB