Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 08:16
Static task
static1
Behavioral task
behavioral1
Sample
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe
Resource
win10v2004-20240412-en
General
-
Target
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe
-
Size
4.2MB
-
MD5
62976fcb3e6f8885c8ef5b24a7d827d4
-
SHA1
6a6b70281168a3217b6d6091c762217c42c2f062
-
SHA256
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81
-
SHA512
379557664212ebdf2eeddb95390dacce522c602d923f881196d5dd2c0b1c82f29431b64ae41cc3869576006625efc1017a670a840db6387d741f0ca1fc599760
-
SSDEEP
98304:yS8Tc81AzKVcNOUNHF6RiNP154spKvDdhObEo7QvVY0ryRAf1Tp7ORg:jEcJzF4UNHqA/dsmoVS4YAf19v
Malware Config
Signatures
-
Glupteba payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/4792-2-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4792-3-0x0000000004250000-0x0000000004B3B000-memory.dmp family_glupteba behavioral2/memory/4792-49-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3640-52-0x0000000003FB0000-0x000000000489B000-memory.dmp family_glupteba behavioral2/memory/3640-53-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3640-127-0x0000000003AB0000-0x0000000003EAF000-memory.dmp family_glupteba behavioral2/memory/3640-138-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/3640-191-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-243-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-253-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-256-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-259-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-262-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-265-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-268-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-271-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-274-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-277-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-280-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-283-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4908-286-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1396 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 4908 csrss.exe 2388 injector.exe 4284 windefender.exe 4528 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4284-252-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4528-255-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4528-261-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe -
Drops file in Windows directory 4 IoCs
Processes:
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe File created C:\Windows\rss\csrss.exe 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 776 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1772 schtasks.exe 4900 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exepowershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exepowershell.exe980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2836 powershell.exe 2836 powershell.exe 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 940 powershell.exe 940 powershell.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe 3460 powershell.exe 3460 powershell.exe 4036 powershell.exe 4036 powershell.exe 768 powershell.exe 768 powershell.exe 1968 powershell.exe 1968 powershell.exe 3808 powershell.exe 3808 powershell.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 4908 csrss.exe 4908 csrss.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 4908 csrss.exe 4908 csrss.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 4908 csrss.exe 4908 csrss.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe 2388 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Token: SeImpersonatePrivilege 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 3460 powershell.exe Token: SeDebugPrivilege 4036 powershell.exe Token: SeDebugPrivilege 768 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeSystemEnvironmentPrivilege 4908 csrss.exe Token: SeSecurityPrivilege 776 sc.exe Token: SeSecurityPrivilege 776 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4792 wrote to memory of 2836 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 4792 wrote to memory of 2836 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 4792 wrote to memory of 2836 4792 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 940 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 940 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 940 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 2300 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe cmd.exe PID 3640 wrote to memory of 2300 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe cmd.exe PID 2300 wrote to memory of 1396 2300 cmd.exe netsh.exe PID 2300 wrote to memory of 1396 2300 cmd.exe netsh.exe PID 3640 wrote to memory of 3460 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 3460 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 3460 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 4036 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 4036 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 4036 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe powershell.exe PID 3640 wrote to memory of 4908 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe csrss.exe PID 3640 wrote to memory of 4908 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe csrss.exe PID 3640 wrote to memory of 4908 3640 980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe csrss.exe PID 4908 wrote to memory of 768 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 768 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 768 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 1968 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 1968 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 1968 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 3808 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 3808 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 3808 4908 csrss.exe powershell.exe PID 4908 wrote to memory of 2388 4908 csrss.exe injector.exe PID 4908 wrote to memory of 2388 4908 csrss.exe injector.exe PID 4284 wrote to memory of 3100 4284 windefender.exe cmd.exe PID 4284 wrote to memory of 3100 4284 windefender.exe cmd.exe PID 4284 wrote to memory of 3100 4284 windefender.exe cmd.exe PID 3100 wrote to memory of 776 3100 cmd.exe sc.exe PID 3100 wrote to memory of 776 3100 cmd.exe sc.exe PID 3100 wrote to memory of 776 3100 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe"C:\Users\Admin\AppData\Local\Temp\980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe"C:\Users\Admin\AppData\Local\Temp\980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1396 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4900 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1564
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1772 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:776
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pke0h34.odf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52f270818ad80d4036144218760e0b8af
SHA1a600f66a839275a748e0e4418380369d1d4f4d1d
SHA2561a8be08b80c465bc330b0f48a790672e01e19f513412c3c044a8caae25620e26
SHA5129225b0270d2ed87417e42f7118c1fbe214a21d803f19c86f996e310a019a8fbe7f74e23b25ae18b91fd7ef02c6002e1edf67253ec3d2fc1f8f21a97d41a5769b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5fc45217755db566c9fb6a08f14a908de
SHA154b44fd26603b6c4870d68b4d187da161b790016
SHA256a5a183a3593d4195d23d137d1706e54031a018b5ded25835f65a2bbeee146644
SHA5127c18dd2254d2424e3d3390916b76fa33a19b99f48835f8179cae00743e2def9fc456ebb5b745271844b521247ede9bf9f00b10fbcd7f98709794eef5da200a60
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b7a90eecf6a7bedb4640457927e06904
SHA1f1af60e3634bfc484604faede38393576a76e902
SHA25654997542294061fbc818d6e555097c0cda194cb72318456e916c6ec2b8be034a
SHA512df65baef5796682c0fa182a6524931e503b20b3cca0f93d2d4904885ca01b9b39bfe84baa8199aab5c2fd91abb330b581e4e7d1af4c40049e32d0eee24749952
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5de1f75d1f7ec24ce4ca6ce9dab1f934f
SHA19b0c18f8e2077993f29197d255dcd2d4572cc307
SHA2564e209b5ae190cfb557a295349df242b56def16ee6fb8f6245eacfb98b3d17b68
SHA512773fe9ccaa8e3cf59c102f56ac14595f167ed581d5289bdafa3a48a34f32cfe38feddc4e098e2013ec7a7e77de487d24b57e03f42a27b7ee1c44af9bba5caad2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5da253ec836dfd9bb22a4823c6d572c92
SHA1d5a123a6991df969e912b2d3039035eb4aaf63f3
SHA2568ccc94301f1fc3452e0bf554b927797990194ea40497cba80f64c4aeceed732e
SHA5121fa107c059928489d6c19ca129b4bbea570753cb80d738a8a482c8292a5722facb4173b56e49fb70e059cadbf48cc055ce7e585e663aae9469a4abc20d910c5b
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD562976fcb3e6f8885c8ef5b24a7d827d4
SHA16a6b70281168a3217b6d6091c762217c42c2f062
SHA256980c306f983d285e13ea544d5e00c3fa00884ccb9f80ddc60c3ebc90485f7f81
SHA512379557664212ebdf2eeddb95390dacce522c602d923f881196d5dd2c0b1c82f29431b64ae41cc3869576006625efc1017a670a840db6387d741f0ca1fc599760
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/940-81-0x0000000007AE0000-0x0000000007AF1000-memory.dmpFilesize
68KB
-
memory/940-55-0x0000000003150000-0x0000000003160000-memory.dmpFilesize
64KB
-
memory/940-78-0x00000000075D0000-0x0000000007674000-memory.dmpFilesize
656KB
-
memory/940-85-0x0000000074480000-0x0000000074C31000-memory.dmpFilesize
7.7MB
-
memory/940-82-0x0000000007B30000-0x0000000007B45000-memory.dmpFilesize
84KB
-
memory/940-67-0x000000007F190000-0x000000007F1A0000-memory.dmpFilesize
64KB
-
memory/940-68-0x0000000070770000-0x00000000707BC000-memory.dmpFilesize
304KB
-
memory/940-69-0x00000000709B0000-0x0000000070D07000-memory.dmpFilesize
3.3MB
-
memory/940-80-0x0000000003150000-0x0000000003160000-memory.dmpFilesize
64KB
-
memory/940-79-0x0000000003150000-0x0000000003160000-memory.dmpFilesize
64KB
-
memory/940-66-0x0000000006B10000-0x0000000006B5C000-memory.dmpFilesize
304KB
-
memory/940-59-0x0000000006080000-0x00000000063D7000-memory.dmpFilesize
3.3MB
-
memory/940-54-0x0000000074480000-0x0000000074C31000-memory.dmpFilesize
7.7MB
-
memory/940-56-0x0000000003150000-0x0000000003160000-memory.dmpFilesize
64KB
-
memory/2836-5-0x00000000743F0000-0x0000000074BA1000-memory.dmpFilesize
7.7MB
-
memory/2836-20-0x0000000006340000-0x000000000635E000-memory.dmpFilesize
120KB
-
memory/2836-42-0x0000000007980000-0x000000000798E000-memory.dmpFilesize
56KB
-
memory/2836-44-0x00000000079E0000-0x00000000079FA000-memory.dmpFilesize
104KB
-
memory/2836-43-0x0000000007990000-0x00000000079A5000-memory.dmpFilesize
84KB
-
memory/2836-45-0x0000000007A00000-0x0000000007A08000-memory.dmpFilesize
32KB
-
memory/2836-48-0x00000000743F0000-0x0000000074BA1000-memory.dmpFilesize
7.7MB
-
memory/2836-4-0x0000000002E40000-0x0000000002E76000-memory.dmpFilesize
216KB
-
memory/2836-19-0x0000000005DF0000-0x0000000006147000-memory.dmpFilesize
3.3MB
-
memory/2836-6-0x0000000002FC0000-0x0000000002FD0000-memory.dmpFilesize
64KB
-
memory/2836-7-0x0000000005620000-0x0000000005C4A000-memory.dmpFilesize
6.2MB
-
memory/2836-40-0x0000000007A20000-0x0000000007AB6000-memory.dmpFilesize
600KB
-
memory/2836-39-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/2836-37-0x0000000007F20000-0x000000000859A000-memory.dmpFilesize
6.5MB
-
memory/2836-38-0x00000000078D0000-0x00000000078EA000-memory.dmpFilesize
104KB
-
memory/2836-36-0x00000000077B0000-0x0000000007854000-memory.dmpFilesize
656KB
-
memory/2836-35-0x0000000007790000-0x00000000077AE000-memory.dmpFilesize
120KB
-
memory/2836-8-0x0000000005570000-0x0000000005592000-memory.dmpFilesize
136KB
-
memory/2836-26-0x00000000707F0000-0x0000000070B47000-memory.dmpFilesize
3.3MB
-
memory/2836-25-0x0000000070660000-0x00000000706AC000-memory.dmpFilesize
304KB
-
memory/2836-24-0x0000000007750000-0x0000000007784000-memory.dmpFilesize
208KB
-
memory/2836-23-0x000000007FB60000-0x000000007FB70000-memory.dmpFilesize
64KB
-
memory/2836-41-0x0000000007940000-0x0000000007951000-memory.dmpFilesize
68KB
-
memory/2836-9-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2836-21-0x0000000006360000-0x00000000063AC000-memory.dmpFilesize
304KB
-
memory/2836-10-0x0000000005CC0000-0x0000000005D26000-memory.dmpFilesize
408KB
-
memory/2836-22-0x00000000068B0000-0x00000000068F6000-memory.dmpFilesize
280KB
-
memory/3460-102-0x0000000070970000-0x0000000070CC7000-memory.dmpFilesize
3.3MB
-
memory/3460-111-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/3460-98-0x00000000056F0000-0x0000000005A47000-memory.dmpFilesize
3.3MB
-
memory/3460-87-0x0000000074480000-0x0000000074C31000-memory.dmpFilesize
7.7MB
-
memory/3460-101-0x0000000070770000-0x00000000707BC000-memory.dmpFilesize
304KB
-
memory/3460-100-0x000000007EFE0000-0x000000007EFF0000-memory.dmpFilesize
64KB
-
memory/3460-88-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/3460-89-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/3460-112-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/3460-114-0x0000000074480000-0x0000000074C31000-memory.dmpFilesize
7.7MB
-
memory/3640-191-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3640-52-0x0000000003FB0000-0x000000000489B000-memory.dmpFilesize
8.9MB
-
memory/3640-51-0x0000000003AB0000-0x0000000003EAF000-memory.dmpFilesize
4.0MB
-
memory/3640-138-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3640-53-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/3640-127-0x0000000003AB0000-0x0000000003EAF000-memory.dmpFilesize
4.0MB
-
memory/4036-116-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4036-128-0x0000000070770000-0x00000000707BC000-memory.dmpFilesize
304KB
-
memory/4036-115-0x0000000074480000-0x0000000074C31000-memory.dmpFilesize
7.7MB
-
memory/4036-129-0x00000000709B0000-0x0000000070D07000-memory.dmpFilesize
3.3MB
-
memory/4036-117-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4284-252-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4528-261-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4528-255-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4792-1-0x0000000003E40000-0x0000000004245000-memory.dmpFilesize
4.0MB
-
memory/4792-3-0x0000000004250000-0x0000000004B3B000-memory.dmpFilesize
8.9MB
-
memory/4792-2-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4792-49-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-265-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-256-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-259-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-253-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-262-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-243-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-268-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-271-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-274-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-277-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-280-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-283-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4908-286-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB