Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 15:10
Static task
static1
Behavioral task
behavioral1
Sample
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe
Resource
win10v2004-20240412-en
General
-
Target
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe
-
Size
4.2MB
-
MD5
646a9692051aa31062443ab79201abfc
-
SHA1
298de1c5af8c71d452824c4db0da1ef3c214f035
-
SHA256
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
-
SHA512
5ca688550dbe12026dc1bb2a02edee4485ed7d9e8db3f7695783b902e329fd368dd9938e5ba701725331fcfc82baae3d36d39117504094d8180124c9ceb6008e
-
SSDEEP
49152:RKOdvREmi8iTwPpeYBnAu4QJI7RESGN2UNQnUyHdr+bW0USBgrsqhT/DWSjgq2Sw:4OLEfT6eYBhfhWV+b2vbWNq2SbuhRp
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4116-2-0x0000000004130000-0x0000000004A1B000-memory.dmp family_glupteba behavioral1/memory/4116-3-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/4116-54-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/720-58-0x0000000003E90000-0x000000000477B000-memory.dmp family_glupteba behavioral1/memory/4116-57-0x0000000004130000-0x0000000004A1B000-memory.dmp family_glupteba behavioral1/memory/720-59-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/720-154-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-259-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-267-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-269-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-271-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-273-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-275-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-277-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-279-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-281-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-283-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-285-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-286-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/3948-289-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2652 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3948 csrss.exe 4752 injector.exe 4152 windefender.exe 4428 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4152-266-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4428-268-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4428-272-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4428-278-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe -
Drops file in Windows directory 4 IoCs
Processes:
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.execsrss.exedescription ioc process File opened for modification C:\Windows\rss b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe File created C:\Windows\rss\csrss.exe b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4244 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5004 schtasks.exe 2616 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeb95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exepowershell.exeb95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3692 powershell.exe 3692 powershell.exe 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 1352 powershell.exe 1352 powershell.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe 4900 powershell.exe 4900 powershell.exe 4900 powershell.exe 2380 powershell.exe 2380 powershell.exe 2380 powershell.exe 4644 powershell.exe 4644 powershell.exe 4644 powershell.exe 4332 powershell.exe 4332 powershell.exe 4332 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 3948 csrss.exe 3948 csrss.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 3948 csrss.exe 3948 csrss.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 3948 csrss.exe 3948 csrss.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe 4752 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeb95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3692 powershell.exe Token: SeDebugPrivilege 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Token: SeImpersonatePrivilege 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe Token: SeDebugPrivilege 1352 powershell.exe Token: SeDebugPrivilege 4900 powershell.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 4332 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeSystemEnvironmentPrivilege 3948 csrss.exe Token: SeSecurityPrivilege 4244 sc.exe Token: SeSecurityPrivilege 4244 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exeb95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4116 wrote to memory of 3692 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 4116 wrote to memory of 3692 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 4116 wrote to memory of 3692 4116 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 1352 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 1352 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 1352 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 1216 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe cmd.exe PID 720 wrote to memory of 1216 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe cmd.exe PID 1216 wrote to memory of 2652 1216 cmd.exe netsh.exe PID 1216 wrote to memory of 2652 1216 cmd.exe netsh.exe PID 720 wrote to memory of 4900 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 4900 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 4900 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 2380 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 2380 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 2380 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe powershell.exe PID 720 wrote to memory of 3948 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe csrss.exe PID 720 wrote to memory of 3948 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe csrss.exe PID 720 wrote to memory of 3948 720 b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe csrss.exe PID 3948 wrote to memory of 4644 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4644 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4644 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4332 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4332 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4332 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4824 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4824 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4824 3948 csrss.exe powershell.exe PID 3948 wrote to memory of 4752 3948 csrss.exe injector.exe PID 3948 wrote to memory of 4752 3948 csrss.exe injector.exe PID 4152 wrote to memory of 1860 4152 windefender.exe cmd.exe PID 4152 wrote to memory of 1860 4152 windefender.exe cmd.exe PID 4152 wrote to memory of 1860 4152 windefender.exe cmd.exe PID 1860 wrote to memory of 4244 1860 cmd.exe sc.exe PID 1860 wrote to memory of 4244 1860 cmd.exe sc.exe PID 1860 wrote to memory of 4244 1860 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe"C:\Users\Admin\AppData\Local\Temp\b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe"C:\Users\Admin\AppData\Local\Temp\b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ihr03tp.1ll.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52ac67fbba3dcbd7ac19e417de9b4fc66
SHA106de9d5066321d7f97ec425e4956a50d808de549
SHA2563de091db89a6c353065384f9298730254de4857bc18670af663ce10e2e20f895
SHA512abb251e0600cdfebdbeec09522c4b88eeb8340f5a222b1d6b58dbf0bf79ac1c062d47e1591fee341342ea20b17c23b0e4b1d8c37737795ed86398ab5759b8c8f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5685975b82e810ebbd2f3dbb371312172
SHA10cec73db0dbf6dcce28811361b220346124951d9
SHA256b1c02dbcb7c811e6c58f84d978407fe90aa7a683307fa37fa45eed74313a9a7c
SHA51282018ed330cd36dd8c0c93fe4fff7a51023171300c5c08ae410d0e92564442b0f2a54c274f53f7e5102ae01a964eeb8a5bfd98be6cf9022a27b59259eb320ca3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b981019801fc8ff0c88b5532ae177d0d
SHA148a5dab78233ed1784560ac8dee9a52caea3816b
SHA256ef071bb82c3c030d7031016aaddd76119d8c38b4c5639bdaedd62f57767abe94
SHA51203d312b326b1ca9ac4868d51832482dd4189409290959d7dbf9c9f0456579b4c718a4113a758ed817008496a82b2898ab4f66baa7bd399e39ed6eb3cc18fb623
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e91600ce54d8968fec82f4b9c2cd9916
SHA14c22f9402240da6389c8a238dc18b58191141bf1
SHA2566100ec658d4bc0c670ee4b2bee617eebe8328f92dd5cb32e2c03d2c66cd69746
SHA5129a20e48f17fbdcef5240e6b88fefa28781c93faa8ee40ec400611268e35492174195b203fd87e88f973cf8a0754f2e245970bbfe97a907ca7396722ce5248cfe
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD58f7b5655d768999f80ec31f2e238882a
SHA19fd2806478116b57714636cf57968a44da578b72
SHA256be4bfdc0d8034ee565302d06e7a3c5458726a358d4685b0521598feff6767ece
SHA512875341198b45ab7215dae34c644e99ca790829573a360e1a6c69ff774d31df5c259425b48e268b26915806ec09eb043a1d6a2737a0f67a473bb21789c8167bf9
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5646a9692051aa31062443ab79201abfc
SHA1298de1c5af8c71d452824c4db0da1ef3c214f035
SHA256b95d5d0e3f458a95241e83876331aa15888f80d93e495682ea796742d3debc3f
SHA5125ca688550dbe12026dc1bb2a02edee4485ed7d9e8db3f7695783b902e329fd368dd9938e5ba701725331fcfc82baae3d36d39117504094d8180124c9ceb6008e
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/720-154-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/720-122-0x0000000003990000-0x0000000003D8C000-memory.dmpFilesize
4.0MB
-
memory/720-56-0x0000000003990000-0x0000000003D8C000-memory.dmpFilesize
4.0MB
-
memory/720-59-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/720-58-0x0000000003E90000-0x000000000477B000-memory.dmpFilesize
8.9MB
-
memory/1352-85-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/1352-73-0x000000007F040000-0x000000007F050000-memory.dmpFilesize
64KB
-
memory/1352-61-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/1352-71-0x0000000006260000-0x00000000065B4000-memory.dmpFilesize
3.3MB
-
memory/1352-72-0x0000000006A10000-0x0000000006A5C000-memory.dmpFilesize
304KB
-
memory/1352-60-0x0000000074D60000-0x0000000075510000-memory.dmpFilesize
7.7MB
-
memory/1352-75-0x0000000070DE0000-0x0000000071134000-memory.dmpFilesize
3.3MB
-
memory/1352-91-0x0000000074D60000-0x0000000075510000-memory.dmpFilesize
7.7MB
-
memory/1352-88-0x0000000007C20000-0x0000000007C34000-memory.dmpFilesize
80KB
-
memory/1352-87-0x0000000007BD0000-0x0000000007BE1000-memory.dmpFilesize
68KB
-
memory/1352-74-0x0000000070C60000-0x0000000070CAC000-memory.dmpFilesize
304KB
-
memory/1352-86-0x00000000078B0000-0x0000000007953000-memory.dmpFilesize
652KB
-
memory/2380-133-0x0000000074D60000-0x0000000075510000-memory.dmpFilesize
7.7MB
-
memory/2380-132-0x0000000005CC0000-0x0000000006014000-memory.dmpFilesize
3.3MB
-
memory/2380-134-0x0000000002B60000-0x0000000002B70000-memory.dmpFilesize
64KB
-
memory/2380-136-0x0000000002B60000-0x0000000002B70000-memory.dmpFilesize
64KB
-
memory/2380-137-0x0000000070C60000-0x0000000070CAC000-memory.dmpFilesize
304KB
-
memory/3692-4-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/3692-30-0x0000000070B60000-0x0000000070BAC000-memory.dmpFilesize
304KB
-
memory/3692-25-0x0000000006DA0000-0x0000000006E16000-memory.dmpFilesize
472KB
-
memory/3692-24-0x0000000006BF0000-0x0000000006C34000-memory.dmpFilesize
272KB
-
memory/3692-23-0x0000000005AC0000-0x0000000005B0C000-memory.dmpFilesize
304KB
-
memory/3692-5-0x0000000002150000-0x0000000002186000-memory.dmpFilesize
216KB
-
memory/3692-22-0x0000000005A70000-0x0000000005A8E000-memory.dmpFilesize
120KB
-
memory/3692-50-0x0000000007200000-0x0000000007208000-memory.dmpFilesize
32KB
-
memory/3692-49-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/3692-48-0x00000000071C0000-0x00000000071D4000-memory.dmpFilesize
80KB
-
memory/3692-47-0x00000000071A0000-0x00000000071AE000-memory.dmpFilesize
56KB
-
memory/3692-46-0x0000000007160000-0x0000000007171000-memory.dmpFilesize
68KB
-
memory/3692-45-0x0000000007260000-0x00000000072F6000-memory.dmpFilesize
600KB
-
memory/3692-44-0x0000000007150000-0x000000000715A000-memory.dmpFilesize
40KB
-
memory/3692-6-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/3692-43-0x0000000007060000-0x0000000007103000-memory.dmpFilesize
652KB
-
memory/3692-41-0x0000000007040000-0x000000000705E000-memory.dmpFilesize
120KB
-
memory/3692-42-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/3692-31-0x0000000070CE0000-0x0000000071034000-memory.dmpFilesize
3.3MB
-
memory/3692-21-0x00000000055C0000-0x0000000005914000-memory.dmpFilesize
3.3MB
-
memory/3692-7-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/3692-8-0x0000000004D90000-0x00000000053B8000-memory.dmpFilesize
6.2MB
-
memory/3692-26-0x00000000074A0000-0x0000000007B1A000-memory.dmpFilesize
6.5MB
-
memory/3692-9-0x0000000004AA0000-0x0000000004AC2000-memory.dmpFilesize
136KB
-
memory/3692-16-0x0000000004C20000-0x0000000004C86000-memory.dmpFilesize
408KB
-
memory/3692-27-0x0000000006E40000-0x0000000006E5A000-memory.dmpFilesize
104KB
-
memory/3692-28-0x000000007F710000-0x000000007F720000-memory.dmpFilesize
64KB
-
memory/3692-29-0x0000000007000000-0x0000000007032000-memory.dmpFilesize
200KB
-
memory/3692-53-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/3692-10-0x0000000004B40000-0x0000000004BA6000-memory.dmpFilesize
408KB
-
memory/3948-259-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-289-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-286-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-285-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-283-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-281-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-279-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-277-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-275-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-273-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-271-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-269-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/3948-267-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4116-2-0x0000000004130000-0x0000000004A1B000-memory.dmpFilesize
8.9MB
-
memory/4116-3-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4116-54-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/4116-57-0x0000000004130000-0x0000000004A1B000-memory.dmpFilesize
8.9MB
-
memory/4116-1-0x0000000003D30000-0x0000000004130000-memory.dmpFilesize
4.0MB
-
memory/4152-266-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4428-278-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4428-268-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4428-272-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4900-94-0x0000000004870000-0x0000000004880000-memory.dmpFilesize
64KB
-
memory/4900-95-0x0000000004870000-0x0000000004880000-memory.dmpFilesize
64KB
-
memory/4900-121-0x0000000074D60000-0x0000000075510000-memory.dmpFilesize
7.7MB
-
memory/4900-93-0x0000000074D60000-0x0000000075510000-memory.dmpFilesize
7.7MB
-
memory/4900-96-0x0000000005720000-0x0000000005A74000-memory.dmpFilesize
3.3MB
-
memory/4900-107-0x000000007F020000-0x000000007F030000-memory.dmpFilesize
64KB
-
memory/4900-109-0x0000000071400000-0x0000000071754000-memory.dmpFilesize
3.3MB
-
memory/4900-108-0x0000000070C60000-0x0000000070CAC000-memory.dmpFilesize
304KB
-
memory/4900-119-0x0000000004870000-0x0000000004880000-memory.dmpFilesize
64KB