Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 11:30
Static task
static1
Behavioral task
behavioral1
Sample
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe
Resource
win10v2004-20240412-en
General
-
Target
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe
-
Size
4.2MB
-
MD5
6f390d75b0daed5bf8d04e2a4a84a0f7
-
SHA1
35fbf77ac55cc59cd5ec69595ff6cfd6c500268e
-
SHA256
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287
-
SHA512
18c9d79906a135f5c81eda717d5851f80165d1364604335c3191849fb68a31890d2debb0ccfc534fde2b63b9da5c01ae491c4007dd4abfb7bdb5361f227162b7
-
SSDEEP
98304:SExeyMsyixS5pRc4vIUtzCuveHCg7xBa+u+nRq:SMby0Sruak17xwf
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/2072-2-0x00000000041B0000-0x0000000004A9B000-memory.dmp family_glupteba behavioral2/memory/2072-3-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3180-52-0x0000000004020000-0x000000000490B000-memory.dmp family_glupteba behavioral2/memory/3180-53-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/2072-66-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3180-137-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/3180-176-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-243-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-254-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-258-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-262-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-266-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-270-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-274-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-278-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-282-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-286-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-290-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-294-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral2/memory/4388-298-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4796 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 4388 csrss.exe 460 injector.exe 1572 windefender.exe 1296 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/1572-252-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1296-257-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1296-265-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe File created C:\Windows\rss\csrss.exe 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2588 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2328 schtasks.exe 1568 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-492 = "India Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exepowershell.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 680 powershell.exe 680 powershell.exe 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 4956 powershell.exe 4956 powershell.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe 2344 powershell.exe 2344 powershell.exe 1384 powershell.exe 1384 powershell.exe 4984 powershell.exe 4984 powershell.exe 4732 powershell.exe 4732 powershell.exe 4152 powershell.exe 4152 powershell.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 4388 csrss.exe 4388 csrss.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 4388 csrss.exe 4388 csrss.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 4388 csrss.exe 4388 csrss.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe 460 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Token: SeImpersonatePrivilege 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 4152 powershell.exe Token: SeSystemEnvironmentPrivilege 4388 csrss.exe Token: SeSecurityPrivilege 2588 sc.exe Token: SeSecurityPrivilege 2588 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 2072 wrote to memory of 680 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 2072 wrote to memory of 680 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 2072 wrote to memory of 680 2072 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 4956 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 4956 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 4956 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 4448 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe cmd.exe PID 3180 wrote to memory of 4448 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe cmd.exe PID 4448 wrote to memory of 4796 4448 cmd.exe netsh.exe PID 4448 wrote to memory of 4796 4448 cmd.exe netsh.exe PID 3180 wrote to memory of 2344 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 2344 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 2344 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 1384 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 1384 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 1384 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe powershell.exe PID 3180 wrote to memory of 4388 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe csrss.exe PID 3180 wrote to memory of 4388 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe csrss.exe PID 3180 wrote to memory of 4388 3180 933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe csrss.exe PID 4388 wrote to memory of 4984 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4984 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4984 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4732 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4732 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4732 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4152 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4152 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 4152 4388 csrss.exe powershell.exe PID 4388 wrote to memory of 460 4388 csrss.exe injector.exe PID 4388 wrote to memory of 460 4388 csrss.exe injector.exe PID 1572 wrote to memory of 5032 1572 windefender.exe cmd.exe PID 1572 wrote to memory of 5032 1572 windefender.exe cmd.exe PID 1572 wrote to memory of 5032 1572 windefender.exe cmd.exe PID 5032 wrote to memory of 2588 5032 cmd.exe sc.exe PID 5032 wrote to memory of 2588 5032 cmd.exe sc.exe PID 5032 wrote to memory of 2588 5032 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe"C:\Users\Admin\AppData\Local\Temp\933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe"C:\Users\Admin\AppData\Local\Temp\933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tla4scc4.yda.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5027d443a3134446e5401e6df1113c9e6
SHA1d48baa5b9cd0a2fd024dc29cb9fd901bcadeeab5
SHA256353d48dda5feacec4c8f379b682627eb8d1bf8a34f237b620b8adceb2048885c
SHA512e2edf060bae39459627fdb52f987314251c42ef0cb888d7a349cf8acc357371955def6a245f4b2be852e6c70a95052cefda8351a315c1d57467b0ae6bfb1f964
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD561db258d4fa7bba47d69d412657f2604
SHA1195b6336cdc638a528f4c2718ab20d36a7a44ac8
SHA2567202b40413646350f233b5ba888992992e0f739735a6da25a8946bfe4e55d4d5
SHA51245904d6aa0ddf1d56f6040a97523b9839bb717a5e900e867c4074fc9f2d4d807066c0e9e7699b8c8854cba291d4c78d04c18710d5b44fc523478142a1336d5fe
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51d09a641332433ea63d64d278dee944e
SHA1d98db1e8ac22a1c637e36c21183e252972461032
SHA256c82b4fd3327768aa2983bf082ef8ff079741bc308a59414d2bab86f705f7cbe4
SHA512e416fd0ff06c338a20cc042461b3c299465eb8b13c04490af19e327824cbbbf4b61985940eb07679142bf84a9b7d3c792e4c3761d5469743c784558e641b5462
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5bef8b8bce49e1daf504e28aaa511aa3e
SHA1d8ac69001e5d1ba5ddf2eb35752d0c66e6bb6696
SHA256a6efcb29f2dee293f2f246bd96666b25513082dd9fa8ba76470ed608bb94f76e
SHA51242de0d72224c179da0bad74eac540beb4ec667c01110514da1e9fdac401626eba91e8936132e07065f8820e0dbfa086f069c2c4f9302fcfdff49acc5b20995d3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b521715386ddc0afe2726ca966c3eda1
SHA1c87343c949b046f6729eab6e4853ac7452dd95f9
SHA2566434d67dead55872656ea3dca8d2b7f9b2d75be53e1db307fcd15d34c859afe3
SHA5121daaf4c2b120a050d74d6cac1d1e05389c520a06b9b3f1c8412c67a7ae56196c4efbd995b10add89672f8724ce0140eb516a7580bdb6f500e6fbcff2b768d41b
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD56f390d75b0daed5bf8d04e2a4a84a0f7
SHA135fbf77ac55cc59cd5ec69595ff6cfd6c500268e
SHA256933a6422663eeccf33860025593175e17c375cfa70e2f963e5a8122f6dd13287
SHA51218c9d79906a135f5c81eda717d5851f80165d1364604335c3191849fb68a31890d2debb0ccfc534fde2b63b9da5c01ae491c4007dd4abfb7bdb5361f227162b7
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/680-35-0x00000000072F0000-0x000000000730E000-memory.dmpFilesize
120KB
-
memory/680-41-0x0000000007580000-0x0000000007616000-memory.dmpFilesize
600KB
-
memory/680-20-0x0000000005E80000-0x0000000005E9E000-memory.dmpFilesize
120KB
-
memory/680-21-0x0000000005EC0000-0x0000000005F0C000-memory.dmpFilesize
304KB
-
memory/680-22-0x0000000006420000-0x0000000006466000-memory.dmpFilesize
280KB
-
memory/680-24-0x00000000072B0000-0x00000000072E4000-memory.dmpFilesize
208KB
-
memory/680-23-0x000000007FB20000-0x000000007FB30000-memory.dmpFilesize
64KB
-
memory/680-25-0x0000000070500000-0x000000007054C000-memory.dmpFilesize
304KB
-
memory/680-26-0x0000000070680000-0x00000000709D7000-memory.dmpFilesize
3.3MB
-
memory/680-36-0x00000000029C0000-0x00000000029D0000-memory.dmpFilesize
64KB
-
memory/680-10-0x0000000005830000-0x0000000005896000-memory.dmpFilesize
408KB
-
memory/680-37-0x0000000007310000-0x00000000073B4000-memory.dmpFilesize
656KB
-
memory/680-39-0x0000000007430000-0x000000000744A000-memory.dmpFilesize
104KB
-
memory/680-38-0x0000000007A70000-0x00000000080EA000-memory.dmpFilesize
6.5MB
-
memory/680-40-0x0000000007470000-0x000000000747A000-memory.dmpFilesize
40KB
-
memory/680-19-0x0000000005A90000-0x0000000005DE7000-memory.dmpFilesize
3.3MB
-
memory/680-42-0x0000000007490000-0x00000000074A1000-memory.dmpFilesize
68KB
-
memory/680-43-0x00000000074E0000-0x00000000074EE000-memory.dmpFilesize
56KB
-
memory/680-44-0x00000000074F0000-0x0000000007505000-memory.dmpFilesize
84KB
-
memory/680-45-0x0000000007540000-0x000000000755A000-memory.dmpFilesize
104KB
-
memory/680-46-0x0000000007560000-0x0000000007568000-memory.dmpFilesize
32KB
-
memory/680-49-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/680-9-0x00000000056C0000-0x0000000005726000-memory.dmpFilesize
408KB
-
memory/680-8-0x0000000004FC0000-0x0000000004FE2000-memory.dmpFilesize
136KB
-
memory/680-6-0x00000000029C0000-0x00000000029D0000-memory.dmpFilesize
64KB
-
memory/680-7-0x0000000005090000-0x00000000056BA000-memory.dmpFilesize
6.2MB
-
memory/680-5-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/680-4-0x00000000029D0000-0x0000000002A06000-memory.dmpFilesize
216KB
-
memory/1296-257-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1296-265-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1384-138-0x000000007EFF0000-0x000000007F000000-memory.dmpFilesize
64KB
-
memory/1384-122-0x00000000057E0000-0x0000000005B37000-memory.dmpFilesize
3.3MB
-
memory/1384-128-0x00000000706A0000-0x00000000709F7000-memory.dmpFilesize
3.3MB
-
memory/1384-127-0x0000000070500000-0x000000007054C000-memory.dmpFilesize
304KB
-
memory/1384-126-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/1384-124-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/1384-121-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/1572-252-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2072-3-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2072-1-0x0000000003DB0000-0x00000000041B0000-memory.dmpFilesize
4.0MB
-
memory/2072-66-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2072-2-0x00000000041B0000-0x0000000004A9B000-memory.dmpFilesize
8.9MB
-
memory/2072-54-0x0000000003DB0000-0x00000000041B0000-memory.dmpFilesize
4.0MB
-
memory/2344-87-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/2344-88-0x00000000047B0000-0x00000000047C0000-memory.dmpFilesize
64KB
-
memory/2344-89-0x00000000047B0000-0x00000000047C0000-memory.dmpFilesize
64KB
-
memory/2344-101-0x0000000070750000-0x0000000070AA7000-memory.dmpFilesize
3.3MB
-
memory/2344-100-0x0000000070500000-0x000000007054C000-memory.dmpFilesize
304KB
-
memory/2344-99-0x000000007F2E0000-0x000000007F2F0000-memory.dmpFilesize
64KB
-
memory/2344-111-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/3180-123-0x0000000003C10000-0x0000000004016000-memory.dmpFilesize
4.0MB
-
memory/3180-137-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3180-51-0x0000000003C10000-0x0000000004016000-memory.dmpFilesize
4.0MB
-
memory/3180-52-0x0000000004020000-0x000000000490B000-memory.dmpFilesize
8.9MB
-
memory/3180-53-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3180-176-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-274-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-290-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-270-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-266-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-286-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-294-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-278-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-258-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-243-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-282-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-298-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-254-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4388-262-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4956-82-0x0000000007E90000-0x0000000007EA5000-memory.dmpFilesize
84KB
-
memory/4956-68-0x0000000070500000-0x000000007054C000-memory.dmpFilesize
304KB
-
memory/4956-69-0x0000000070750000-0x0000000070AA7000-memory.dmpFilesize
3.3MB
-
memory/4956-55-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/4956-56-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB
-
memory/4956-78-0x0000000007910000-0x00000000079B4000-memory.dmpFilesize
656KB
-
memory/4956-79-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/4956-80-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/4956-81-0x0000000007E40000-0x0000000007E51000-memory.dmpFilesize
68KB
-
memory/4956-57-0x0000000006420000-0x0000000006777000-memory.dmpFilesize
3.3MB
-
memory/4956-67-0x000000007F880000-0x000000007F890000-memory.dmpFilesize
64KB
-
memory/4956-85-0x0000000074290000-0x0000000074A41000-memory.dmpFilesize
7.7MB