Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe
Resource
win10v2004-20240412-en
General
-
Target
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe
-
Size
4.2MB
-
MD5
2af77f8ec96e690ca5166d8ff270cf79
-
SHA1
9c2492b43b1d84e95e89cca9da2b83d961083163
-
SHA256
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1
-
SHA512
e08e8fc854b6323be920f41a0f8d23919ec1aa0e6c748797fc75ccde865bd34ed65835992aa66cc236b070c5c2bcaeff03dc6187d50314167ff307e6982eaacf
-
SSDEEP
98304:i9dcOUBEbybSH36R/JhlYZJkRBAK/yVZyNfNI1XCYNEH:QyBJSqZXeZGRgrygZK
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4200-2-0x0000000006520000-0x0000000006E0B000-memory.dmp family_glupteba behavioral1/memory/1776-55-0x0000000006500000-0x0000000006DEB000-memory.dmp family_glupteba behavioral1/memory/4200-83-0x0000000006520000-0x0000000006E0B000-memory.dmp family_glupteba behavioral1/memory/1776-154-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/4200-159-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-257-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-259-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-261-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-271-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-274-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-277-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-280-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-283-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-286-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-289-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-291-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-294-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral1/memory/3740-297-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2484 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3740 csrss.exe 4960 injector.exe 3224 windefender.exe 3340 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/3224-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3340-272-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3340-278-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe File created C:\Windows\rss\csrss.exe 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1356 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3076 schtasks.exe 4608 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exepowershell.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3684 powershell.exe 3684 powershell.exe 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 2024 powershell.exe 2024 powershell.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe 4832 powershell.exe 4832 powershell.exe 4832 powershell.exe 3804 powershell.exe 3804 powershell.exe 3804 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 4648 powershell.exe 4648 powershell.exe 4648 powershell.exe 3456 powershell.exe 3456 powershell.exe 3456 powershell.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 3740 csrss.exe 3740 csrss.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 3740 csrss.exe 3740 csrss.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe 4960 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3684 powershell.exe Token: SeDebugPrivilege 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Token: SeImpersonatePrivilege 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 3804 powershell.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeDebugPrivilege 3456 powershell.exe Token: SeSystemEnvironmentPrivilege 3740 csrss.exe Token: SeSecurityPrivilege 1356 sc.exe Token: SeSecurityPrivilege 1356 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4200 wrote to memory of 3684 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 4200 wrote to memory of 3684 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 4200 wrote to memory of 3684 4200 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 2024 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 2024 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 2024 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 1356 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe cmd.exe PID 1776 wrote to memory of 1356 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe cmd.exe PID 1356 wrote to memory of 2484 1356 cmd.exe netsh.exe PID 1356 wrote to memory of 2484 1356 cmd.exe netsh.exe PID 1776 wrote to memory of 4832 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 4832 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 4832 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 3804 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 3804 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 3804 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe powershell.exe PID 1776 wrote to memory of 3740 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe csrss.exe PID 1776 wrote to memory of 3740 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe csrss.exe PID 1776 wrote to memory of 3740 1776 33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe csrss.exe PID 3740 wrote to memory of 3052 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 3052 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 3052 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 4648 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 4648 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 4648 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 3456 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 3456 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 3456 3740 csrss.exe powershell.exe PID 3740 wrote to memory of 4960 3740 csrss.exe injector.exe PID 3740 wrote to memory of 4960 3740 csrss.exe injector.exe PID 3224 wrote to memory of 4964 3224 windefender.exe cmd.exe PID 3224 wrote to memory of 4964 3224 windefender.exe cmd.exe PID 3224 wrote to memory of 4964 3224 windefender.exe cmd.exe PID 4964 wrote to memory of 1356 4964 cmd.exe sc.exe PID 4964 wrote to memory of 1356 4964 cmd.exe sc.exe PID 4964 wrote to memory of 1356 4964 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe"C:\Users\Admin\AppData\Local\Temp\33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe"C:\Users\Admin\AppData\Local\Temp\33aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cr5iykln.h0v.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52a3cb8dadeda0297290613bd233fdffb
SHA1664c407e802bc9da4226bd177c3ffc0e8f037dd8
SHA2567689d5a9e39bbfae6b13d9872fe0bfcb169260607efa74cf9bcd8a75497eafd2
SHA512bc1247bde3cc461e8a7274c795a189e9373ac3933bc25d4289a83107f9a253ce8cc808a6b19b3cba509634aa259d656da0f1870661f55645803ace25cbe1624f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e0ed63835eb2ebdaa630ccddbb769fdc
SHA1fff7899fc94bc9790f7c671f98774ab0c48c2083
SHA2566ffeac3cc60cdd38417a0d1a14e72a622f227c8ebd9eaf1a3b62123ab1a289b2
SHA512cf9255f300fd206c845ccd6eb6916a2afebdd1957a561703a5837bb31292e9b37975a6de92cdd5cf27812294560b8d19e303366d6c779a61a6e2bd5101551d7a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5299e40963eeb92db0eba7e527480fc88
SHA1d7253beb6e3ee3e99fedbf8e6ba2dddd0fdaac34
SHA256e5d478d241201a754501db8860a3a2e0262c286565cff81f1d2c72b86724a7f5
SHA5125f8a65e62b5572a5668c130e475a32ac522c2dad451285dcbc5af6713099f2db4c16c646e6d2c89f988273615b779c4a7874bb9b7a22b5e2bc597163b46bc8e5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD556d618cd9121f6420154ac753a8b26cf
SHA185e3e7427bdfd4fd3881526bdecf2754bf57005a
SHA256a2804f3aa7a5dd402c8a849c31d01655fc433eb844605eb4989663dad8c36e00
SHA512a141cb6491d1a69ce6feca4e714027c021d13ad70991e962d81d7d4b6dccea801fe4d66713d92c9e46536e9e7091f0acdc891fd322b5a1d8bb27cbc73063bf49
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f67b22063b2e83e63e220fe43f1d6efc
SHA1a4ed4a860e0378bc39086f78263b7b1a5bc8743d
SHA256d2beed6f6d35b013091374027feac7f4be1350656cdda58a5fab97b5e7808c87
SHA512034cb639363407806752f62a7cb3987451aeb6c591a149248a9d1a29608ff0b3118e02101ea736387a1719f85b9528bfa2c1ff257132a4e23dfd8172e7d56a73
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD52af77f8ec96e690ca5166d8ff270cf79
SHA19c2492b43b1d84e95e89cca9da2b83d961083163
SHA25633aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1
SHA512e08e8fc854b6323be920f41a0f8d23919ec1aa0e6c748797fc75ccde865bd34ed65835992aa66cc236b070c5c2bcaeff03dc6187d50314167ff307e6982eaacf
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1776-154-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/1776-118-0x0000000004950000-0x0000000004D54000-memory.dmpFilesize
4.0MB
-
memory/1776-54-0x0000000004950000-0x0000000004D54000-memory.dmpFilesize
4.0MB
-
memory/1776-55-0x0000000006500000-0x0000000006DEB000-memory.dmpFilesize
8.9MB
-
memory/2024-70-0x000000007FC00000-0x000000007FC10000-memory.dmpFilesize
64KB
-
memory/2024-84-0x0000000002F10000-0x0000000002F20000-memory.dmpFilesize
64KB
-
memory/2024-57-0x0000000002F10000-0x0000000002F20000-memory.dmpFilesize
64KB
-
memory/2024-69-0x0000000005E10000-0x0000000006164000-memory.dmpFilesize
3.3MB
-
memory/2024-59-0x0000000002F10000-0x0000000002F20000-memory.dmpFilesize
64KB
-
memory/2024-90-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/2024-87-0x0000000007840000-0x0000000007854000-memory.dmpFilesize
80KB
-
memory/2024-86-0x00000000077F0000-0x0000000007801000-memory.dmpFilesize
68KB
-
memory/2024-71-0x00000000700E0000-0x000000007012C000-memory.dmpFilesize
304KB
-
memory/2024-82-0x00000000074C0000-0x0000000007563000-memory.dmpFilesize
652KB
-
memory/2024-56-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/2024-85-0x0000000002F10000-0x0000000002F20000-memory.dmpFilesize
64KB
-
memory/2024-72-0x0000000070260000-0x00000000705B4000-memory.dmpFilesize
3.3MB
-
memory/3224-269-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3340-272-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3340-278-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3684-5-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3684-9-0x0000000005580000-0x00000000055E6000-memory.dmpFilesize
408KB
-
memory/3684-52-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/3684-23-0x00000000062D0000-0x0000000006314000-memory.dmpFilesize
272KB
-
memory/3684-22-0x0000000005DA0000-0x0000000005DEC000-memory.dmpFilesize
304KB
-
memory/3684-49-0x00000000074E0000-0x00000000074E8000-memory.dmpFilesize
32KB
-
memory/3684-47-0x00000000074A0000-0x00000000074B4000-memory.dmpFilesize
80KB
-
memory/3684-26-0x0000000007120000-0x000000000713A000-memory.dmpFilesize
104KB
-
memory/3684-46-0x0000000007490000-0x000000000749E000-memory.dmpFilesize
56KB
-
memory/3684-45-0x0000000007450000-0x0000000007461000-memory.dmpFilesize
68KB
-
memory/3684-44-0x00000000074F0000-0x0000000007586000-memory.dmpFilesize
600KB
-
memory/3684-43-0x0000000007430000-0x000000000743A000-memory.dmpFilesize
40KB
-
memory/3684-42-0x0000000007340000-0x00000000073E3000-memory.dmpFilesize
652KB
-
memory/3684-25-0x0000000007780000-0x0000000007DFA000-memory.dmpFilesize
6.5MB
-
memory/3684-27-0x000000007FAA0000-0x000000007FAB0000-memory.dmpFilesize
64KB
-
memory/3684-28-0x00000000072E0000-0x0000000007312000-memory.dmpFilesize
200KB
-
memory/3684-30-0x00000000706B0000-0x0000000070A04000-memory.dmpFilesize
3.3MB
-
memory/3684-40-0x0000000007320000-0x000000000733E000-memory.dmpFilesize
120KB
-
memory/3684-41-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3684-29-0x00000000700E0000-0x000000007012C000-memory.dmpFilesize
304KB
-
memory/3684-21-0x0000000005D60000-0x0000000005D7E000-memory.dmpFilesize
120KB
-
memory/3684-48-0x0000000007590000-0x00000000075AA000-memory.dmpFilesize
104KB
-
memory/3684-3-0x00000000027A0000-0x00000000027D6000-memory.dmpFilesize
216KB
-
memory/3684-4-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/3684-20-0x0000000005720000-0x0000000005A74000-memory.dmpFilesize
3.3MB
-
memory/3684-24-0x0000000007080000-0x00000000070F6000-memory.dmpFilesize
472KB
-
memory/3684-6-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3684-7-0x0000000004F50000-0x0000000005578000-memory.dmpFilesize
6.2MB
-
memory/3684-8-0x0000000004D90000-0x0000000004DB2000-memory.dmpFilesize
136KB
-
memory/3684-10-0x00000000055F0000-0x0000000005656000-memory.dmpFilesize
408KB
-
memory/3740-259-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-274-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-297-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-294-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-291-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-289-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-286-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-283-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-280-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-277-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-271-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-261-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3740-257-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/3804-124-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/3804-123-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/3804-131-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/3804-136-0x00000000700E0000-0x000000007012C000-memory.dmpFilesize
304KB
-
memory/4200-58-0x0000000004970000-0x0000000004D76000-memory.dmpFilesize
4.0MB
-
memory/4200-2-0x0000000006520000-0x0000000006E0B000-memory.dmpFilesize
8.9MB
-
memory/4200-1-0x0000000004970000-0x0000000004D76000-memory.dmpFilesize
4.0MB
-
memory/4200-159-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4200-83-0x0000000006520000-0x0000000006E0B000-memory.dmpFilesize
8.9MB
-
memory/4832-107-0x00000000700E0000-0x000000007012C000-memory.dmpFilesize
304KB
-
memory/4832-119-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4832-106-0x000000007F550000-0x000000007F560000-memory.dmpFilesize
64KB
-
memory/4832-120-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4832-93-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4832-108-0x0000000070860000-0x0000000070BB4000-memory.dmpFilesize
3.3MB
-
memory/4832-92-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB
-
memory/4832-104-0x0000000006360000-0x00000000066B4000-memory.dmpFilesize
3.3MB
-
memory/4832-94-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4832-122-0x0000000074240000-0x00000000749F0000-memory.dmpFilesize
7.7MB