Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 07:04
Static task
static1
Behavioral task
behavioral1
Sample
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe
Resource
win10v2004-20240412-en
General
-
Target
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe
-
Size
4.2MB
-
MD5
a0455783057716ecd106cc4baa50fb59
-
SHA1
3eeafb5a2a3b82d757f1e995b9cf44c0bc15ffc4
-
SHA256
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014
-
SHA512
325ad4f8c4975e2277948968ae7d6751e2d17b98becb3d46b4b59ff8737cdef97d967f6149bdc94171eec99ccd6a3be7729c94a8e60314bc72aaabbb5918d219
-
SSDEEP
98304:PNkDk7Y2e9fhWY+LbgLFpBVAayCN/CB0J4dlv7S/k29jp/49:Wk7LeNhW/+FpBVAa19Ce4dlv7wZ49
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4364-2-0x0000000005270000-0x0000000005B5B000-memory.dmp family_glupteba behavioral1/memory/4364-3-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/836-57-0x0000000005150000-0x0000000005A3B000-memory.dmp family_glupteba behavioral1/memory/836-58-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/4364-71-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/836-187-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-256-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-267-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-271-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-275-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-279-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-283-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-287-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-291-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-295-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-299-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-303-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-307-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba behavioral1/memory/1828-311-0x0000000000400000-0x0000000003111000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 780 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1828 csrss.exe 2624 injector.exe 960 windefender.exe 4196 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/960-264-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4196-270-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4196-278-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe -
Drops file in Windows directory 4 IoCs
Processes:
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1700 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1792 schtasks.exe 1628 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exepowershell.exepowershell.exebd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exebd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exepowershell.exebd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4200 powershell.exe 4200 powershell.exe 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 3600 powershell.exe 3600 powershell.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe 2236 powershell.exe 2236 powershell.exe 4964 powershell.exe 4964 powershell.exe 1428 powershell.exe 1428 powershell.exe 540 powershell.exe 540 powershell.exe 336 powershell.exe 336 powershell.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 1828 csrss.exe 1828 csrss.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 1828 csrss.exe 1828 csrss.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 1828 csrss.exe 1828 csrss.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe 2624 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exebd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4200 powershell.exe Token: SeDebugPrivilege 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Token: SeImpersonatePrivilege 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe Token: SeDebugPrivilege 3600 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 4964 powershell.exe Token: SeDebugPrivilege 1428 powershell.exe Token: SeDebugPrivilege 540 powershell.exe Token: SeDebugPrivilege 336 powershell.exe Token: SeSystemEnvironmentPrivilege 1828 csrss.exe Token: SeSecurityPrivilege 1700 sc.exe Token: SeSecurityPrivilege 1700 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exebd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4364 wrote to memory of 4200 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 4364 wrote to memory of 4200 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 4364 wrote to memory of 4200 4364 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 3600 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 3600 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 3600 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 3856 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe cmd.exe PID 836 wrote to memory of 3856 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe cmd.exe PID 3856 wrote to memory of 780 3856 cmd.exe netsh.exe PID 3856 wrote to memory of 780 3856 cmd.exe netsh.exe PID 836 wrote to memory of 2236 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 2236 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 2236 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 4964 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 4964 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 4964 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe powershell.exe PID 836 wrote to memory of 1828 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe csrss.exe PID 836 wrote to memory of 1828 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe csrss.exe PID 836 wrote to memory of 1828 836 bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe csrss.exe PID 1828 wrote to memory of 1428 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 1428 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 1428 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 540 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 540 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 540 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 336 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 336 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 336 1828 csrss.exe powershell.exe PID 1828 wrote to memory of 2624 1828 csrss.exe injector.exe PID 1828 wrote to memory of 2624 1828 csrss.exe injector.exe PID 960 wrote to memory of 1484 960 windefender.exe cmd.exe PID 960 wrote to memory of 1484 960 windefender.exe cmd.exe PID 960 wrote to memory of 1484 960 windefender.exe cmd.exe PID 1484 wrote to memory of 1700 1484 cmd.exe sc.exe PID 1484 wrote to memory of 1700 1484 cmd.exe sc.exe PID 1484 wrote to memory of 1700 1484 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe"C:\Users\Admin\AppData\Local\Temp\bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe"C:\Users\Admin\AppData\Local\Temp\bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1792 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1172
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:336 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2624 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1628 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4196
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ozzocvv.jqg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5606223b48254665a6665f62f60986a8d
SHA12c48f10db910f691f1129289372027a74b2e05f0
SHA2568a760353c83e4696575967cbabf0012b5ee536477d2a66b8bb951145ea36278d
SHA512988a446c2dd92cb2bff6f087235c6f022dfd98d6d619aaff9161d6e658af36489301ea45d54e704af2be1dc7eab33fd193c1df06f5bf531dcdc9c67e52f09f4e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5d792efbe7df5b27d5871ee9c1115c033
SHA108a521d9e1ee746a4a55fb6d47357bf8959322e0
SHA2560bce2455aa034ca4495769facdf7e6199145ec77bc924701b3b740bff7a0fe0a
SHA512925fedd12455354b9f337b8e965f0b94dd7ec21b1cd91e667cdd095c7791b9d0bd655843c4057a93968e6f79b85cd0bfd1ff3f6a35ebba0ba7694c2e1db0ea3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51185d979dfca3388d54004cb1d0c65b2
SHA1c784dc0e82021ddc898300d4397c2b12ebb21842
SHA256c0b5b33c6713c508d1d85d12abcf89683cd40625f0e027e113f3f9ec89c944ea
SHA512373b45f16e95d3659a4cfcb6e2865a70508ece2ef04e262a31b902d199fe59af6090a7ba6a97980130ab232ee43d8caf29653a83449ef567f589d046bd8924e9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54f2b2e42a3955065a147f5cdacbf92ba
SHA10256a9886db73bbd32c5bc9a4dbd82a7cf2e59fa
SHA25632e7dfa564b862b3627e415163b782a338c8c42209832475c9c39637fd0bd612
SHA5124bce2c05fb6ef230e7db06b434de3133f689aeb643cd3e7ed9fc21c4b901f125296d8d691229a198d0f3af9aeec34ed76dadcf558ad6a4edab77c8ee436affc8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD575a601ec4b046d9fcc4a5259b02ce92a
SHA15475c926ebde3fc043eb8e7364bbec3c676afd7c
SHA256b5cf2bdfed40096277ddce210c41678ce0b7aa03d0c72d17145d5cae56c4bee3
SHA5125354859c2c657e2bb338c9eb2280bf50ed362611eac8100df0f5218c92caa46c54f1de03a77bdf9c12e24e644cf775dabc0748ee74f85b7a088104dc43712c34
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5a0455783057716ecd106cc4baa50fb59
SHA13eeafb5a2a3b82d757f1e995b9cf44c0bc15ffc4
SHA256bd735fb40da8ebda13128b9e3b8e3048d7235b8150de04cc9e20d48a4e360014
SHA512325ad4f8c4975e2277948968ae7d6751e2d17b98becb3d46b4b59ff8737cdef97d967f6149bdc94171eec99ccd6a3be7729c94a8e60314bc72aaabbb5918d219
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/836-58-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/836-57-0x0000000005150000-0x0000000005A3B000-memory.dmpFilesize
8.9MB
-
memory/836-55-0x0000000004D50000-0x000000000514B000-memory.dmpFilesize
4.0MB
-
memory/836-125-0x0000000004D50000-0x000000000514B000-memory.dmpFilesize
4.0MB
-
memory/836-187-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/960-264-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1828-307-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-279-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-256-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-283-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-287-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-291-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-267-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-295-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-299-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-303-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-311-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-275-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/1828-271-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/2236-94-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/2236-109-0x0000000070870000-0x00000000708BC000-memory.dmpFilesize
304KB
-
memory/2236-96-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/2236-95-0x0000000006230000-0x0000000006584000-memory.dmpFilesize
3.3MB
-
memory/2236-108-0x000000007EF90000-0x000000007EFA0000-memory.dmpFilesize
64KB
-
memory/2236-110-0x0000000070FF0000-0x0000000071344000-memory.dmpFilesize
3.3MB
-
memory/2236-97-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/2236-121-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/3600-61-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/3600-84-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/3600-60-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/3600-91-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/3600-88-0x0000000007D80000-0x0000000007D94000-memory.dmpFilesize
80KB
-
memory/3600-72-0x000000007F0F0000-0x000000007F100000-memory.dmpFilesize
64KB
-
memory/3600-73-0x0000000070870000-0x00000000708BC000-memory.dmpFilesize
304KB
-
memory/3600-74-0x00000000709F0000-0x0000000070D44000-memory.dmpFilesize
3.3MB
-
memory/3600-86-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/3600-85-0x0000000007A30000-0x0000000007AD3000-memory.dmpFilesize
652KB
-
memory/3600-59-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/3600-87-0x0000000007D30000-0x0000000007D41000-memory.dmpFilesize
68KB
-
memory/4196-278-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4196-270-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4200-31-0x00000000709F0000-0x0000000070D44000-memory.dmpFilesize
3.3MB
-
memory/4200-8-0x0000000005460000-0x0000000005A88000-memory.dmpFilesize
6.2MB
-
memory/4200-5-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/4200-53-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/4200-50-0x00000000077D0000-0x00000000077D8000-memory.dmpFilesize
32KB
-
memory/4200-49-0x0000000007890000-0x00000000078AA000-memory.dmpFilesize
104KB
-
memory/4200-48-0x00000000077A0000-0x00000000077B4000-memory.dmpFilesize
80KB
-
memory/4200-47-0x0000000007790000-0x000000000779E000-memory.dmpFilesize
56KB
-
memory/4200-46-0x0000000007750000-0x0000000007761000-memory.dmpFilesize
68KB
-
memory/4200-45-0x00000000077F0000-0x0000000007886000-memory.dmpFilesize
600KB
-
memory/4200-4-0x0000000002A80000-0x0000000002AB6000-memory.dmpFilesize
216KB
-
memory/4200-6-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4200-7-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4200-44-0x0000000004E20000-0x0000000004E30000-memory.dmpFilesize
64KB
-
memory/4200-43-0x0000000007730000-0x000000000773A000-memory.dmpFilesize
40KB
-
memory/4200-16-0x0000000005A90000-0x0000000005AF6000-memory.dmpFilesize
408KB
-
memory/4200-9-0x00000000051B0000-0x00000000051D2000-memory.dmpFilesize
136KB
-
memory/4200-42-0x0000000007640000-0x00000000076E3000-memory.dmpFilesize
652KB
-
memory/4200-41-0x0000000007620000-0x000000000763E000-memory.dmpFilesize
120KB
-
memory/4200-12-0x0000000005350000-0x00000000053B6000-memory.dmpFilesize
408KB
-
memory/4200-30-0x0000000070870000-0x00000000708BC000-memory.dmpFilesize
304KB
-
memory/4200-28-0x000000007EEA0000-0x000000007EEB0000-memory.dmpFilesize
64KB
-
memory/4200-29-0x00000000075E0000-0x0000000007612000-memory.dmpFilesize
200KB
-
memory/4200-27-0x0000000007420000-0x000000000743A000-memory.dmpFilesize
104KB
-
memory/4200-26-0x0000000007A70000-0x00000000080EA000-memory.dmpFilesize
6.5MB
-
memory/4200-25-0x0000000007310000-0x0000000007386000-memory.dmpFilesize
472KB
-
memory/4200-24-0x0000000007170000-0x00000000071B4000-memory.dmpFilesize
272KB
-
memory/4200-23-0x00000000065C0000-0x000000000660C000-memory.dmpFilesize
304KB
-
memory/4200-22-0x0000000006060000-0x000000000607E000-memory.dmpFilesize
120KB
-
memory/4200-21-0x0000000005C00000-0x0000000005F54000-memory.dmpFilesize
3.3MB
-
memory/4364-1-0x0000000004E60000-0x0000000005262000-memory.dmpFilesize
4.0MB
-
memory/4364-71-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/4364-56-0x0000000004E60000-0x0000000005262000-memory.dmpFilesize
4.0MB
-
memory/4364-3-0x0000000000400000-0x0000000003111000-memory.dmpFilesize
45.1MB
-
memory/4364-2-0x0000000005270000-0x0000000005B5B000-memory.dmpFilesize
8.9MB
-
memory/4964-137-0x0000000070FF0000-0x0000000071344000-memory.dmpFilesize
3.3MB
-
memory/4964-136-0x0000000070870000-0x00000000708BC000-memory.dmpFilesize
304KB
-
memory/4964-124-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4964-122-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/4964-123-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB