Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 16:01
Static task
static1
Behavioral task
behavioral1
Sample
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe
Resource
win10v2004-20240412-en
General
-
Target
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe
-
Size
4.2MB
-
MD5
bc2b02717bb8d502b198bdd0a162c05a
-
SHA1
c1003e4d4870d3ecf9ed07640343da1755a3bfce
-
SHA256
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
-
SHA512
22c96151c4c6a3376d4cb42fd70f2cdabafc61d2d7f5b4e6f1b8884cee00eaa421861f4b3d24be8790c94295c08b4ab56e2d9451ac7e2429a0f66e1570982f5c
-
SSDEEP
98304:HoZCtMNcIJm/Wi5iI7vKblq/qDx6472PxO1xv/KiJeX:H3OuIEug7vwUGt7S+nKl
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-2-0x0000000003EF0000-0x00000000047DB000-memory.dmp family_glupteba behavioral1/memory/2532-3-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1388-56-0x0000000003E00000-0x00000000046EB000-memory.dmp family_glupteba behavioral1/memory/1388-58-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2532-71-0x0000000003EF0000-0x00000000047DB000-memory.dmp family_glupteba behavioral1/memory/2532-86-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1388-188-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-258-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-269-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-273-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-277-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-281-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-285-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-289-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-293-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-297-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-301-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-305-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-309-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/1804-313-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1980 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1804 csrss.exe 3244 injector.exe 4944 windefender.exe 624 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4944-267-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/624-272-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/624-279-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe -
Drops file in Windows directory 4 IoCs
Processes:
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.execsrss.exedescription ioc process File opened for modification C:\Windows\rss dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe File created C:\Windows\rss\csrss.exe dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4536 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2520 schtasks.exe 3064 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exedbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exepowershell.exedbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2096 powershell.exe 2096 powershell.exe 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 4592 powershell.exe 4592 powershell.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe 4568 powershell.exe 4568 powershell.exe 4408 powershell.exe 4408 powershell.exe 4504 powershell.exe 4504 powershell.exe 4316 powershell.exe 4316 powershell.exe 1044 powershell.exe 1044 powershell.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 1804 csrss.exe 1804 csrss.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 1804 csrss.exe 1804 csrss.exe 3244 injector.exe 3244 injector.exe 1804 csrss.exe 1804 csrss.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe 3244 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exedbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Token: SeImpersonatePrivilege 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 4568 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 4316 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeSystemEnvironmentPrivilege 1804 csrss.exe Token: SeSecurityPrivilege 4536 sc.exe Token: SeSecurityPrivilege 4536 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exedbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 2532 wrote to memory of 2096 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 2532 wrote to memory of 2096 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 2532 wrote to memory of 2096 2532 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4592 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4592 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4592 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 3160 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe cmd.exe PID 1388 wrote to memory of 3160 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe cmd.exe PID 3160 wrote to memory of 1980 3160 cmd.exe netsh.exe PID 3160 wrote to memory of 1980 3160 cmd.exe netsh.exe PID 1388 wrote to memory of 4568 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4568 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4568 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4408 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4408 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 4408 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe powershell.exe PID 1388 wrote to memory of 1804 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe csrss.exe PID 1388 wrote to memory of 1804 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe csrss.exe PID 1388 wrote to memory of 1804 1388 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe csrss.exe PID 1804 wrote to memory of 4504 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 4504 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 4504 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 4316 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 4316 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 4316 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 1044 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 1044 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 1044 1804 csrss.exe powershell.exe PID 1804 wrote to memory of 3244 1804 csrss.exe injector.exe PID 1804 wrote to memory of 3244 1804 csrss.exe injector.exe PID 4944 wrote to memory of 4028 4944 windefender.exe cmd.exe PID 4944 wrote to memory of 4028 4944 windefender.exe cmd.exe PID 4944 wrote to memory of 4028 4944 windefender.exe cmd.exe PID 4028 wrote to memory of 4536 4028 cmd.exe sc.exe PID 4028 wrote to memory of 4536 4028 cmd.exe sc.exe PID 4028 wrote to memory of 4536 4028 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsqcmruz.w4h.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56ff764feb3c0b2cb159dda27e4a129fb
SHA16408262e55010c05811adbd269a1bde394bb707f
SHA2562bea865742304e18ba033973d7792da324a7f967ea160eab6b4034c7ebcd5f6d
SHA5121dbc7f292bf54ab1bbccfbfedcff809638f5f1f4677e64dc079021d93c47d46031a2c4294073734e01fb3210870c1166d511c33ae5300c22bd09dd0ac92a7212
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f31357cb214a51ef9da7661f822f99d7
SHA1a2be3144bf61988f2224dda747d19e120a7e76e1
SHA2569b348c296cf7865f0026a7ba00b994ca576a3b18b616a86c33ca6badf2067c55
SHA512486c0ef8ebe0f2fc6e512f23015d3c00236a7fd38de236e41a523151b6edda67312f6401faed28fa81e940ece7945ff37c3741ea86ee4476e214e6bc6450f9c8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD586a0b62d2353157fa25f50962409c913
SHA1a740ff1b6cd8df63e96015d4a5ccf9d78a5a5f10
SHA2562bd1e3e5fc53a68e5f889f903d78ca6fd1e67f8ac13bf31725161e340c628d09
SHA512c2c5b2156adec31620f0d30da33635e7cbda8053084d77d6e3ca99111b59607205934ba233f7f017cd3cb9e15520de6f63e3d977561c9de3e8fb96c6cbc9f353
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c763cd541f5014e052821b7f15f370e7
SHA14988bee6b6071a20f5a9d26af964eba80d15addc
SHA25655e2993e15cdc3cf09352d010cd23e25cf019308ca92163b50dc069a290277ee
SHA512af16d5b5e26dfabbeb2b30f743d655052ce86c0714dbf02bbe13cbdf16a50ad92f7e73da2bf4cd2e889fa9a5e843d83e0405f182dbe7d16a475246396df4a414
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57c5b87acf31c4bbf200bd4cf57404286
SHA1d3003f07ae1eaf9cb11be7d42acc1da6f502712c
SHA2562a4dc0dee19fccbb1c1b5810551481dc5be1dceda76dda6572a94cc0b7af8cb4
SHA512223ada0ae336eb7aa74a5a397c8811e1f7f20cd72051d6c6bc74b86e2f0560c9e1eef5f5da4c9f4f9a47b541fe41b47f430915b7cf06c19dfea492b5267bd532
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5bc2b02717bb8d502b198bdd0a162c05a
SHA1c1003e4d4870d3ecf9ed07640343da1755a3bfce
SHA256dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
SHA51222c96151c4c6a3376d4cb42fd70f2cdabafc61d2d7f5b4e6f1b8884cee00eaa421861f4b3d24be8790c94295c08b4ab56e2d9451ac7e2429a0f66e1570982f5c
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/624-279-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/624-272-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1388-55-0x0000000003A00000-0x0000000003E00000-memory.dmpFilesize
4.0MB
-
memory/1388-58-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1388-56-0x0000000003E00000-0x00000000046EB000-memory.dmpFilesize
8.9MB
-
memory/1388-188-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1388-120-0x0000000003A00000-0x0000000003E00000-memory.dmpFilesize
4.0MB
-
memory/1804-313-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-277-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-281-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-285-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-289-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-293-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-297-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-301-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-305-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-309-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-273-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-269-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/1804-258-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2096-25-0x0000000007670000-0x00000000076E6000-memory.dmpFilesize
472KB
-
memory/2096-11-0x0000000005E00000-0x0000000005E66000-memory.dmpFilesize
408KB
-
memory/2096-50-0x0000000007C50000-0x0000000007C58000-memory.dmpFilesize
32KB
-
memory/2096-53-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/2096-48-0x0000000007C10000-0x0000000007C24000-memory.dmpFilesize
80KB
-
memory/2096-47-0x0000000007BF0000-0x0000000007BFE000-memory.dmpFilesize
56KB
-
memory/2096-4-0x0000000002EF0000-0x0000000002F26000-memory.dmpFilesize
216KB
-
memory/2096-46-0x0000000007BB0000-0x0000000007BC1000-memory.dmpFilesize
68KB
-
memory/2096-45-0x0000000007CB0000-0x0000000007D46000-memory.dmpFilesize
600KB
-
memory/2096-29-0x0000000007A50000-0x0000000007A82000-memory.dmpFilesize
200KB
-
memory/2096-44-0x0000000007BA0000-0x0000000007BAA000-memory.dmpFilesize
40KB
-
memory/2096-5-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/2096-30-0x0000000070630000-0x000000007067C000-memory.dmpFilesize
304KB
-
memory/2096-41-0x0000000007A90000-0x0000000007AAE000-memory.dmpFilesize
120KB
-
memory/2096-42-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2096-43-0x0000000007AB0000-0x0000000007B53000-memory.dmpFilesize
652KB
-
memory/2096-31-0x00000000707B0000-0x0000000070B04000-memory.dmpFilesize
3.3MB
-
memory/2096-6-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2096-28-0x000000007F550000-0x000000007F560000-memory.dmpFilesize
64KB
-
memory/2096-26-0x0000000007D70000-0x00000000083EA000-memory.dmpFilesize
6.5MB
-
memory/2096-27-0x0000000007610000-0x000000000762A000-memory.dmpFilesize
104KB
-
memory/2096-24-0x00000000068C0000-0x0000000006904000-memory.dmpFilesize
272KB
-
memory/2096-23-0x0000000006510000-0x000000000655C000-memory.dmpFilesize
304KB
-
memory/2096-22-0x00000000064D0000-0x00000000064EE000-memory.dmpFilesize
120KB
-
memory/2096-21-0x0000000005FB0000-0x0000000006304000-memory.dmpFilesize
3.3MB
-
memory/2096-49-0x0000000007C60000-0x0000000007C7A000-memory.dmpFilesize
104KB
-
memory/2096-10-0x00000000056A0000-0x0000000005706000-memory.dmpFilesize
408KB
-
memory/2096-9-0x0000000005500000-0x0000000005522000-memory.dmpFilesize
136KB
-
memory/2096-8-0x0000000005760000-0x0000000005D88000-memory.dmpFilesize
6.2MB
-
memory/2096-7-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2532-86-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2532-71-0x0000000003EF0000-0x00000000047DB000-memory.dmpFilesize
8.9MB
-
memory/2532-57-0x0000000003AF0000-0x0000000003EEF000-memory.dmpFilesize
4.0MB
-
memory/2532-3-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2532-2-0x0000000003EF0000-0x00000000047DB000-memory.dmpFilesize
8.9MB
-
memory/2532-1-0x0000000003AF0000-0x0000000003EEF000-memory.dmpFilesize
4.0MB
-
memory/4408-136-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/4408-135-0x0000000005890000-0x0000000005BE4000-memory.dmpFilesize
3.3MB
-
memory/4568-95-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/4568-124-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/4568-122-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/4568-121-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/4568-108-0x000000007F7E0000-0x000000007F7F0000-memory.dmpFilesize
64KB
-
memory/4568-109-0x0000000070630000-0x000000007067C000-memory.dmpFilesize
304KB
-
memory/4568-110-0x00000000707D0000-0x0000000070B24000-memory.dmpFilesize
3.3MB
-
memory/4568-94-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/4568-106-0x0000000005ED0000-0x0000000006224000-memory.dmpFilesize
3.3MB
-
memory/4568-96-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/4592-92-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/4592-89-0x0000000007510000-0x0000000007524000-memory.dmpFilesize
80KB
-
memory/4592-88-0x00000000074C0000-0x00000000074D1000-memory.dmpFilesize
68KB
-
memory/4592-87-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4592-75-0x0000000070D90000-0x00000000710E4000-memory.dmpFilesize
3.3MB
-
memory/4592-85-0x0000000006FD0000-0x0000000007073000-memory.dmpFilesize
652KB
-
memory/4592-73-0x000000007F730000-0x000000007F740000-memory.dmpFilesize
64KB
-
memory/4592-74-0x0000000070630000-0x000000007067C000-memory.dmpFilesize
304KB
-
memory/4592-72-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/4592-66-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4592-65-0x00000000059C0000-0x0000000005D14000-memory.dmpFilesize
3.3MB
-
memory/4592-64-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4944-267-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB