Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe
Resource
win10v2004-20240412-en
General
-
Target
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe
-
Size
4.2MB
-
MD5
cd7abb7f72c10bc806045edc520dabd1
-
SHA1
4e572840035be07195385adf80d1ae4206a80f6c
-
SHA256
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad
-
SHA512
3ecfad6dae02a01b26225dbb7b58964a6d8d6076e0f478a4deaa84ff2064bdd89b6eabee2ef5b1b459d1f3bb63923ab1ddde71fd6c7347507760743cfe61f5de
-
SSDEEP
49152:Ar1oHj0tlV0f9s8MWzX04BUpcYbKwdRAyQZQ93cNVdRbmMzimZc5ZnjMAqqwRi8S:ABcwtA9b44emOBqNRUORBLE4AjzN
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/3308-2-0x00000000040D0000-0x00000000049BB000-memory.dmp family_glupteba behavioral2/memory/3308-3-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4600-53-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4600-54-0x0000000003FC0000-0x00000000048AB000-memory.dmp family_glupteba behavioral2/memory/3308-96-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4600-136-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/4600-204-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-239-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-250-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-253-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-257-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-261-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-265-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-269-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-273-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-278-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-281-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-285-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-289-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba behavioral2/memory/1532-293-0x0000000000400000-0x0000000001DF8000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1388 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1532 csrss.exe 1360 injector.exe 2144 windefender.exe 276 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/2144-247-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/276-254-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/276-262-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe File created C:\Windows\rss\csrss.exe 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3552 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3696 schtasks.exe 840 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exepowershell.exe04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 804 powershell.exe 804 powershell.exe 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 3148 powershell.exe 3148 powershell.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe 616 powershell.exe 616 powershell.exe 436 powershell.exe 436 powershell.exe 1856 powershell.exe 1856 powershell.exe 4560 powershell.exe 4560 powershell.exe 3572 powershell.exe 3572 powershell.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1532 csrss.exe 1532 csrss.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1532 csrss.exe 1532 csrss.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1532 csrss.exe 1532 csrss.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe 1360 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 804 powershell.exe Token: SeDebugPrivilege 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Token: SeImpersonatePrivilege 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe Token: SeDebugPrivilege 3148 powershell.exe Token: SeDebugPrivilege 616 powershell.exe Token: SeDebugPrivilege 436 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeDebugPrivilege 3572 powershell.exe Token: SeSystemEnvironmentPrivilege 1532 csrss.exe Token: SeSecurityPrivilege 3552 sc.exe Token: SeSecurityPrivilege 3552 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3308 wrote to memory of 804 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 3308 wrote to memory of 804 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 3308 wrote to memory of 804 3308 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 3148 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 3148 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 3148 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 3368 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe cmd.exe PID 4600 wrote to memory of 3368 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe cmd.exe PID 3368 wrote to memory of 1388 3368 cmd.exe netsh.exe PID 3368 wrote to memory of 1388 3368 cmd.exe netsh.exe PID 4600 wrote to memory of 616 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 616 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 616 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 436 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 436 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 436 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe powershell.exe PID 4600 wrote to memory of 1532 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe csrss.exe PID 4600 wrote to memory of 1532 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe csrss.exe PID 4600 wrote to memory of 1532 4600 04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe csrss.exe PID 1532 wrote to memory of 1856 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 1856 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 1856 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 4560 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 4560 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 4560 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 3572 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 3572 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 3572 1532 csrss.exe powershell.exe PID 1532 wrote to memory of 1360 1532 csrss.exe injector.exe PID 1532 wrote to memory of 1360 1532 csrss.exe injector.exe PID 2144 wrote to memory of 900 2144 windefender.exe cmd.exe PID 2144 wrote to memory of 900 2144 windefender.exe cmd.exe PID 2144 wrote to memory of 900 2144 windefender.exe cmd.exe PID 900 wrote to memory of 3552 900 cmd.exe sc.exe PID 900 wrote to memory of 3552 900 cmd.exe sc.exe PID 900 wrote to memory of 3552 900 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe"C:\Users\Admin\AppData\Local\Temp\04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe"C:\Users\Admin\AppData\Local\Temp\04139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzl2buzf.gjm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD546ae1108965174af1307e19240663115
SHA13f3c8ae4fd31ac4ca006d0030948ccb95e9f535b
SHA25635c524d58c68f159649d24c086a03840b13b8aa033c4194e9be1703baa6acb15
SHA512e1be503c413b079941096a2388b36c4acd67b79fd6f422add9a22f4e0301e18ecdd64d45fbe39eb81c6805be5dc915804397d9ceca3e745eb03c934bab4f32a6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ecb991d5cdc0c6ed6c97bcd71c82193d
SHA17e8f6dd869160fd950964e1d86172d09caee620f
SHA256f678d9653b3298c79d62226239b56a36eaf9da41332bbc9d18990ce1605988b0
SHA512888ee98df480aaed0165311635b23995fbdcc8d42d49d8b83ce22dfdafbc6d6b4364d1988271473843b4dd9d351dea9352263b31ad7e4646970edcd44378dd8b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5646bda0b1b437a0dbdc118a1b4724336
SHA106bada98125218f14d0506822517957fdc75fa41
SHA2567a2d0e57b5c89458961ef487560a0837ae5fda7476b2a1cc6dadafcee8de11ca
SHA512d72063ac4cd9584a2178d050b11d6ac7e252f16daa59ce2cf5309d49c49d06f741b60077d06412e68de8d193ed0ebc9936c442bc503e2ec08f4a677a7459b2f5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c6b1bd7b6ab7a0e101d974fc60890641
SHA198f22c859018e12d7db28cbe53eeaca7a779f3a2
SHA256a1f0421a1bcfc239a22007682198a9b80c47a06f1492de340d14cb24c76de9bd
SHA5128569d52fe54a8abab111d9078dbb2804c20b50f0cbc50e34e44f56e7d184595ec2ca91b5ebf5c2e38589b205fd8cbd346395e643bdf5b0e0623622b22a619ae7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD50f767d295b7f4eebc00cfd5a8a43f884
SHA11760d02c0eeb4f21b6d48b1631970c65a8c5e235
SHA25669bc2ffedd631f20c1f474aff114368d9efc4002cb42fa666ac1f6aec6060885
SHA512cbbcc7f33693e74dabed6c22f7cd9f1bf63c8d109816a42a5b5bec50d3e0880536732f0aac1f41a3278dc01b5fbd343e4443cee68f04c2b31c9df7387d76237d
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5cd7abb7f72c10bc806045edc520dabd1
SHA14e572840035be07195385adf80d1ae4206a80f6c
SHA25604139bf08e27d38c87f44ea88bd882fccfb02dfaa28f63c2073ba1bb90214dad
SHA5123ecfad6dae02a01b26225dbb7b58964a6d8d6076e0f478a4deaa84ff2064bdd89b6eabee2ef5b1b459d1f3bb63923ab1ddde71fd6c7347507760743cfe61f5de
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/276-262-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/276-254-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/436-126-0x0000000070530000-0x000000007057C000-memory.dmpFilesize
304KB
-
memory/436-127-0x00000000706B0000-0x0000000070A07000-memory.dmpFilesize
3.3MB
-
memory/436-115-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/436-114-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/436-113-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/436-137-0x000000007F1C0000-0x000000007F1D0000-memory.dmpFilesize
64KB
-
memory/616-112-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/616-110-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/616-101-0x0000000070780000-0x0000000070AD7000-memory.dmpFilesize
3.3MB
-
memory/616-100-0x0000000070530000-0x000000007057C000-memory.dmpFilesize
304KB
-
memory/616-99-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/616-98-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/616-87-0x00000000059A0000-0x0000000005CF7000-memory.dmpFilesize
3.3MB
-
memory/804-26-0x0000000070530000-0x000000007057C000-memory.dmpFilesize
304KB
-
memory/804-5-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/804-43-0x0000000007DB0000-0x0000000007DC1000-memory.dmpFilesize
68KB
-
memory/804-44-0x0000000007E00000-0x0000000007E0E000-memory.dmpFilesize
56KB
-
memory/804-45-0x0000000007E10000-0x0000000007E25000-memory.dmpFilesize
84KB
-
memory/804-46-0x0000000007E60000-0x0000000007E7A000-memory.dmpFilesize
104KB
-
memory/804-47-0x0000000007E80000-0x0000000007E88000-memory.dmpFilesize
32KB
-
memory/804-50-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/804-42-0x0000000007EA0000-0x0000000007F36000-memory.dmpFilesize
600KB
-
memory/804-4-0x00000000032F0000-0x0000000003326000-memory.dmpFilesize
216KB
-
memory/804-6-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/804-7-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/804-8-0x0000000005C00000-0x000000000622A000-memory.dmpFilesize
6.2MB
-
memory/804-9-0x00000000058E0000-0x0000000005902000-memory.dmpFilesize
136KB
-
memory/804-10-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/804-11-0x0000000005B60000-0x0000000005BC6000-memory.dmpFilesize
408KB
-
memory/804-20-0x00000000063E0000-0x0000000006737000-memory.dmpFilesize
3.3MB
-
memory/804-21-0x0000000006790000-0x00000000067AE000-memory.dmpFilesize
120KB
-
memory/804-22-0x00000000067D0000-0x000000000681C000-memory.dmpFilesize
304KB
-
memory/804-23-0x0000000007900000-0x0000000007946000-memory.dmpFilesize
280KB
-
memory/804-24-0x000000007FDA0000-0x000000007FDB0000-memory.dmpFilesize
64KB
-
memory/804-25-0x0000000007BD0000-0x0000000007C04000-memory.dmpFilesize
208KB
-
memory/804-37-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/804-38-0x0000000007C30000-0x0000000007CD4000-memory.dmpFilesize
656KB
-
memory/804-41-0x0000000007D90000-0x0000000007D9A000-memory.dmpFilesize
40KB
-
memory/804-36-0x0000000007C10000-0x0000000007C2E000-memory.dmpFilesize
120KB
-
memory/804-39-0x0000000008390000-0x0000000008A0A000-memory.dmpFilesize
6.5MB
-
memory/804-40-0x0000000007D50000-0x0000000007D6A000-memory.dmpFilesize
104KB
-
memory/804-27-0x00000000706B0000-0x0000000070A07000-memory.dmpFilesize
3.3MB
-
memory/1532-239-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-293-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-289-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-285-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-281-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-278-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-273-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-269-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-265-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-261-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-257-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-253-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/1532-250-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/2144-247-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3148-68-0x00000000706B0000-0x0000000070A07000-memory.dmpFilesize
3.3MB
-
memory/3148-79-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/3148-55-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/3148-85-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/3148-82-0x0000000007130000-0x0000000007145000-memory.dmpFilesize
84KB
-
memory/3148-81-0x00000000070E0000-0x00000000070F1000-memory.dmpFilesize
68KB
-
memory/3148-57-0x00000000742C0000-0x0000000074A71000-memory.dmpFilesize
7.7MB
-
memory/3148-78-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/3148-80-0x0000000006DC0000-0x0000000006E64000-memory.dmpFilesize
656KB
-
memory/3148-56-0x00000000047C0000-0x00000000047D0000-memory.dmpFilesize
64KB
-
memory/3148-67-0x0000000070530000-0x000000007057C000-memory.dmpFilesize
304KB
-
memory/3148-69-0x000000007FCC0000-0x000000007FCD0000-memory.dmpFilesize
64KB
-
memory/3308-3-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/3308-1-0x0000000003CC0000-0x00000000040C5000-memory.dmpFilesize
4.0MB
-
memory/3308-2-0x00000000040D0000-0x00000000049BB000-memory.dmpFilesize
8.9MB
-
memory/3308-66-0x0000000003CC0000-0x00000000040C5000-memory.dmpFilesize
4.0MB
-
memory/3308-96-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4600-116-0x0000000003BC0000-0x0000000003FBF000-memory.dmpFilesize
4.0MB
-
memory/4600-136-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4600-52-0x0000000003BC0000-0x0000000003FBF000-memory.dmpFilesize
4.0MB
-
memory/4600-53-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB
-
memory/4600-54-0x0000000003FC0000-0x00000000048AB000-memory.dmpFilesize
8.9MB
-
memory/4600-204-0x0000000000400000-0x0000000001DF8000-memory.dmpFilesize
26.0MB