Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-04-2024 15:25
Static task
static1
Behavioral task
behavioral1
Sample
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe
Resource
win10v2004-20240412-en
General
-
Target
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe
-
Size
4.2MB
-
MD5
d4317a56585d66eec3cb61651a71d51b
-
SHA1
08e6268279d52271ec944f4b24d9fd5e6e1eaf11
-
SHA256
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc
-
SHA512
cfd63ad19666a0521b68b6c8182b4588bca638745789eaab1d0d74b03eb90d24e00e8e30f33b51aa36e547682c67160b623dba60c844fb9cfad36ff549eb2a89
-
SSDEEP
98304:xYLCMptDmsu+9iprwjFTOTj/zIJhxobwLXF8FmbNEpdL19bKj:FkDFH9njBOTWhxocJmmbsdxhW
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/5092-2-0x00000000066A0000-0x0000000006F8B000-memory.dmp family_glupteba behavioral2/memory/2200-52-0x0000000006640000-0x0000000006F2B000-memory.dmp family_glupteba behavioral2/memory/5092-98-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/2200-175-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-237-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-241-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-243-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-254-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-259-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-263-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-266-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-270-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-274-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-279-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-282-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-287-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4428-291-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4864 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 4428 csrss.exe 760 injector.exe 4028 windefender.exe 4716 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4028-252-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4716-257-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4716-265-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe -
Drops file in Windows directory 4 IoCs
Processes:
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe File created C:\Windows\rss\csrss.exe 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3868 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 936 schtasks.exe 1104 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exepowershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exepowershell.exe7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 5048 powershell.exe 5048 powershell.exe 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2744 powershell.exe 2744 powershell.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe 3436 powershell.exe 3436 powershell.exe 4092 powershell.exe 4092 powershell.exe 780 powershell.exe 780 powershell.exe 2732 powershell.exe 2732 powershell.exe 4732 powershell.exe 4732 powershell.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 4428 csrss.exe 4428 csrss.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 4428 csrss.exe 4428 csrss.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe 760 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Token: SeImpersonatePrivilege 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 3436 powershell.exe Token: SeDebugPrivilege 4092 powershell.exe Token: SeDebugPrivilege 780 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeSystemEnvironmentPrivilege 4428 csrss.exe Token: SeSecurityPrivilege 3868 sc.exe Token: SeSecurityPrivilege 3868 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 5092 wrote to memory of 5048 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 5092 wrote to memory of 5048 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 5092 wrote to memory of 5048 5092 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 2744 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 2744 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 2744 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 2008 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe cmd.exe PID 2200 wrote to memory of 2008 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe cmd.exe PID 2008 wrote to memory of 4864 2008 cmd.exe netsh.exe PID 2008 wrote to memory of 4864 2008 cmd.exe netsh.exe PID 2200 wrote to memory of 3436 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 3436 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 3436 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 4092 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 4092 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 4092 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe powershell.exe PID 2200 wrote to memory of 4428 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe csrss.exe PID 2200 wrote to memory of 4428 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe csrss.exe PID 2200 wrote to memory of 4428 2200 7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe csrss.exe PID 4428 wrote to memory of 780 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 780 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 780 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 2732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 2732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 2732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 4732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 4732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 4732 4428 csrss.exe powershell.exe PID 4428 wrote to memory of 760 4428 csrss.exe injector.exe PID 4428 wrote to memory of 760 4428 csrss.exe injector.exe PID 4028 wrote to memory of 4692 4028 windefender.exe cmd.exe PID 4028 wrote to memory of 4692 4028 windefender.exe cmd.exe PID 4028 wrote to memory of 4692 4028 windefender.exe cmd.exe PID 4692 wrote to memory of 3868 4692 cmd.exe sc.exe PID 4692 wrote to memory of 3868 4692 cmd.exe sc.exe PID 4692 wrote to memory of 3868 4692 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe"C:\Users\Admin\AppData\Local\Temp\7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe"C:\Users\Admin\AppData\Local\Temp\7d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zwhchgak.msa.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56529c1768276a05efb465514a8417950
SHA141aa84f90eb67acb99c8cbf5a792fd60cb184c74
SHA256a944f0b28b7d4e72cc22b8429e191a21350a8354a30c577ae2c38782e576c344
SHA512eb6fbb7d192c3f410ebc851d6cfa22cd788e9688df29faeef11464eeb16be4b5a5c95161f34701e2eee238ac78b9f27bd8b2317b9dcad3593a6ce38f3fbe4c45
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5515511488588b5b3025eb1e607c5206c
SHA119bea531ffecb86a414900c1c0dc69bb7ae72edd
SHA2563dacc975c7ac1d2e860fdd730fb9120a1c18106002b2d2eab2e7ef42ec2965e5
SHA512acc7b85c879804ab15dac3842e5e9e983fcbaaae1823c8b88c6ea6405f4a54f99253c3228f02b88f068e68530419fde8efdc85d88280747b0a2fbb4970036309
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ea7ce01c13d6506d53246899713c9715
SHA118fa8c583719c4b7d52315ee9668b675c63258b2
SHA25695982615094c37bad9e854f646291ca3799eb9be87da03fa734704f114645596
SHA512ba21f2bc2a56dc2b77aa8ecb6a809676fdf083bdcab50dee1d4dab7bca9148def40eab4837424f72ccb62875054cd9a3325f7212dfa43e7c30633ce1b6026e37
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b694c972b3ddc8870cd1e46087cd2a85
SHA184f846bdeb1704356aac349bf41e3e72d19521a2
SHA2563c37c8dcf3189c979d0828b4da6f10105acc2bbb91c240cda982e85b4c74be43
SHA51204772e704eab8264377aaae5cfd725244cf097995609a6e121960ebc3d57938bdfa71df8cf1ce6d268ad54cb15aab2738da0fa4d45d497358d5a0ce14a73440c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57f5f587d3b20c56251a724881264a3da
SHA1c8fd019144177c97b62f53074d9877e2eeab02d6
SHA2569ad7b0f2e8f954581010318f827493aba5537ccc1d19460e1821646c86413d0d
SHA51230b889c7a927ec98674c27ac2d7d145eefcfdfb328a30547f4b9ab4193df520458bd1f37bf37fd157d29661ca3d72c76ce1a603f901f489c9db4cdc19b0be2b0
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5d4317a56585d66eec3cb61651a71d51b
SHA108e6268279d52271ec944f4b24d9fd5e6e1eaf11
SHA2567d26c9667d16f5a82bc49fdca11515d7f95df4e8c4fb1fe11983f3154b0971cc
SHA512cfd63ad19666a0521b68b6c8182b4588bca638745789eaab1d0d74b03eb90d24e00e8e30f33b51aa36e547682c67160b623dba60c844fb9cfad36ff549eb2a89
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/2200-175-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/2200-51-0x0000000004AA0000-0x0000000004E99000-memory.dmpFilesize
4.0MB
-
memory/2200-126-0x0000000004AA0000-0x0000000004E99000-memory.dmpFilesize
4.0MB
-
memory/2200-52-0x0000000006640000-0x0000000006F2B000-memory.dmpFilesize
8.9MB
-
memory/2744-80-0x00000000075C0000-0x00000000075D5000-memory.dmpFilesize
84KB
-
memory/2744-53-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/2744-83-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/2744-79-0x0000000007570000-0x0000000007581000-memory.dmpFilesize
68KB
-
memory/2744-77-0x0000000007230000-0x00000000072D4000-memory.dmpFilesize
656KB
-
memory/2744-78-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/2744-66-0x000000007EFE0000-0x000000007EFF0000-memory.dmpFilesize
64KB
-
memory/2744-68-0x0000000071000000-0x0000000071357000-memory.dmpFilesize
3.3MB
-
memory/2744-67-0x0000000070DB0000-0x0000000070DFC000-memory.dmpFilesize
304KB
-
memory/2744-56-0x0000000005B30000-0x0000000005E87000-memory.dmpFilesize
3.3MB
-
memory/2744-55-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/2744-54-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/3436-100-0x0000000071040000-0x0000000071397000-memory.dmpFilesize
3.3MB
-
memory/3436-109-0x000000007FBC0000-0x000000007FBD0000-memory.dmpFilesize
64KB
-
memory/3436-93-0x0000000005890000-0x0000000005BE7000-memory.dmpFilesize
3.3MB
-
memory/3436-95-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/3436-94-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/3436-96-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/3436-99-0x0000000070DB0000-0x0000000070DFC000-memory.dmpFilesize
304KB
-
memory/3436-111-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/3436-110-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/3436-113-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/4028-252-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4092-128-0x000000007FA90000-0x000000007FAA0000-memory.dmpFilesize
64KB
-
memory/4092-116-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/4092-115-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/4092-114-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/4092-127-0x0000000070DB0000-0x0000000070DFC000-memory.dmpFilesize
304KB
-
memory/4092-138-0x0000000004840000-0x0000000004850000-memory.dmpFilesize
64KB
-
memory/4092-129-0x0000000071000000-0x0000000071357000-memory.dmpFilesize
3.3MB
-
memory/4428-241-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-270-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-291-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-287-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-282-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-279-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-274-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-237-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-266-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-243-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-263-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-259-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4428-254-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4716-257-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4716-265-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5048-46-0x0000000007840000-0x0000000007848000-memory.dmpFilesize
32KB
-
memory/5048-43-0x0000000007750000-0x000000000775E000-memory.dmpFilesize
56KB
-
memory/5048-42-0x0000000007710000-0x0000000007721000-memory.dmpFilesize
68KB
-
memory/5048-21-0x00000000060A0000-0x00000000060EC000-memory.dmpFilesize
304KB
-
memory/5048-10-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/5048-22-0x00000000065C0000-0x0000000006606000-memory.dmpFilesize
280KB
-
memory/5048-9-0x0000000005240000-0x00000000052A6000-memory.dmpFilesize
408KB
-
memory/5048-49-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/5048-35-0x0000000007550000-0x000000000756E000-memory.dmpFilesize
120KB
-
memory/5048-45-0x0000000007860000-0x000000000787A000-memory.dmpFilesize
104KB
-
memory/5048-8-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/5048-7-0x0000000005350000-0x000000000597A000-memory.dmpFilesize
6.2MB
-
memory/5048-5-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/5048-6-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/5048-4-0x0000000074B40000-0x00000000752F1000-memory.dmpFilesize
7.7MB
-
memory/5048-3-0x0000000004BD0000-0x0000000004C06000-memory.dmpFilesize
216KB
-
memory/5048-40-0x00000000076E0000-0x00000000076EA000-memory.dmpFilesize
40KB
-
memory/5048-41-0x00000000077A0000-0x0000000007836000-memory.dmpFilesize
600KB
-
memory/5048-38-0x0000000007CE0000-0x000000000835A000-memory.dmpFilesize
6.5MB
-
memory/5048-20-0x0000000006060000-0x000000000607E000-memory.dmpFilesize
120KB
-
memory/5048-44-0x0000000007760000-0x0000000007775000-memory.dmpFilesize
84KB
-
memory/5048-26-0x0000000070FE0000-0x0000000071337000-memory.dmpFilesize
3.3MB
-
memory/5048-39-0x00000000076A0000-0x00000000076BA000-memory.dmpFilesize
104KB
-
memory/5048-36-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/5048-23-0x000000007F940000-0x000000007F950000-memory.dmpFilesize
64KB
-
memory/5048-24-0x0000000007510000-0x0000000007544000-memory.dmpFilesize
208KB
-
memory/5048-19-0x0000000005B70000-0x0000000005EC7000-memory.dmpFilesize
3.3MB
-
memory/5048-25-0x0000000070DB0000-0x0000000070DFC000-memory.dmpFilesize
304KB
-
memory/5048-37-0x0000000007570000-0x0000000007614000-memory.dmpFilesize
656KB
-
memory/5092-98-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/5092-65-0x00000000049C0000-0x0000000004DBA000-memory.dmpFilesize
4.0MB
-
memory/5092-2-0x00000000066A0000-0x0000000006F8B000-memory.dmpFilesize
8.9MB
-
memory/5092-1-0x00000000049C0000-0x0000000004DBA000-memory.dmpFilesize
4.0MB