Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 09:03
Static task
static1
Behavioral task
behavioral1
Sample
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe
Resource
win10v2004-20240426-en
General
-
Target
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe
-
Size
4.1MB
-
MD5
f9c69e775782789a071258a77c9dc44f
-
SHA1
9ab93375475c4ed1c39538c4410013b2d0ea6955
-
SHA256
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3
-
SHA512
405c403bc631e41d3a0795aa17c48d39cb0fb7ea4c7e5567b594ce165322480f92b54cb9ee1f2fe77c2f7343c2b3538747d295384f11e6f63fd9840aa2c46e5b
-
SSDEEP
98304:wErTbmYqgZ1XudKeC70JrifsEkbyxLCxltfr4Ppsv6xaCIa:DD1Z1UwAUfrk2xOxPr4PpsvyaCIa
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/228-2-0x0000000004A10000-0x00000000052FB000-memory.dmp family_glupteba behavioral1/memory/228-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/228-54-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/228-79-0x0000000004A10000-0x00000000052FB000-memory.dmp family_glupteba behavioral1/memory/228-84-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/228-108-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/5084-107-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/5084-135-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-211-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-219-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-230-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-232-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-236-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-239-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-242-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-245-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-248-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-251-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1536-254-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3036 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1536 csrss.exe 436 injector.exe 4108 windefender.exe 372 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4108-223-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/372-226-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4108-228-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/372-231-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/372-237-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe File created C:\Windows\rss\csrss.exe d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1868 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1812 powershell.exe 4928 powershell.exe 1080 powershell.exe 860 powershell.exe 1096 powershell.exe 4320 powershell.exe 2084 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4144 schtasks.exe 3340 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exepowershell.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4928 powershell.exe 4928 powershell.exe 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 1080 powershell.exe 1080 powershell.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe 860 powershell.exe 860 powershell.exe 1096 powershell.exe 1096 powershell.exe 4320 powershell.exe 4320 powershell.exe 2084 powershell.exe 2084 powershell.exe 1812 powershell.exe 1812 powershell.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 1536 csrss.exe 1536 csrss.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 1536 csrss.exe 1536 csrss.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 1536 csrss.exe 1536 csrss.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe 436 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4928 powershell.exe Token: SeDebugPrivilege 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Token: SeImpersonatePrivilege 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 2084 powershell.exe Token: SeDebugPrivilege 1812 powershell.exe Token: SeSystemEnvironmentPrivilege 1536 csrss.exe Token: SeSecurityPrivilege 1868 sc.exe Token: SeSecurityPrivilege 1868 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exed2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 228 wrote to memory of 4928 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 228 wrote to memory of 4928 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 228 wrote to memory of 4928 228 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1080 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1080 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1080 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 2680 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe cmd.exe PID 5084 wrote to memory of 2680 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe cmd.exe PID 2680 wrote to memory of 3036 2680 cmd.exe netsh.exe PID 2680 wrote to memory of 3036 2680 cmd.exe netsh.exe PID 5084 wrote to memory of 860 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 860 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 860 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1096 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1096 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1096 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe powershell.exe PID 5084 wrote to memory of 1536 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe csrss.exe PID 5084 wrote to memory of 1536 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe csrss.exe PID 5084 wrote to memory of 1536 5084 d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe csrss.exe PID 1536 wrote to memory of 4320 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 4320 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 4320 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 2084 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 2084 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 2084 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 1812 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 1812 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 1812 1536 csrss.exe powershell.exe PID 1536 wrote to memory of 436 1536 csrss.exe injector.exe PID 1536 wrote to memory of 436 1536 csrss.exe injector.exe PID 4108 wrote to memory of 3624 4108 windefender.exe cmd.exe PID 4108 wrote to memory of 3624 4108 windefender.exe cmd.exe PID 4108 wrote to memory of 3624 4108 windefender.exe cmd.exe PID 3624 wrote to memory of 1868 3624 cmd.exe sc.exe PID 3624 wrote to memory of 1868 3624 cmd.exe sc.exe PID 3624 wrote to memory of 1868 3624 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe"C:\Users\Admin\AppData\Local\Temp\d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe"C:\Users\Admin\AppData\Local\Temp\d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sduqk3a3.bmr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD50aaafad52c0131979169c8be8fb1e5d5
SHA19575f6b7f7e9db5bf1d8f083d3f5582bb3c15fc9
SHA2563e8f9f9089ff4699c1f8df735f83aff3da39a951783a6a58f2d23a8eba9eb941
SHA5125fb482005a347c8001f5849f589b7792c875b6faf13e2a311a19b7167163880f2319c4153d646c881028155fd02ea83ea2809e5908803cfc63c310802c59e7db
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52d3508c7ed452e8ff7cbc125162fa308
SHA1f82510ab951c2c497368dfd20ce9e26d9778e4ee
SHA256819348a3e12b19220749df1316861e3ebf12465edf7d3fe29ba000bde8d9ce33
SHA5121cba7e6d8ea194dc789ef47688ea81d16bf52faf9c6d2626ff49bf8d97329c7ca7393f2b090919e86e072f977cf9bb1e55edc4b27710099469591979b32770a6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51e9fbb4d037aab5b74833f1afca8c87e
SHA1ee95129b3166f694ac48e835ab45b82aefc3155d
SHA25698946269cee95b6138042698b8eae4b5578705b5c5034d4c534c137cba5e63a0
SHA512bf7791f8a30530f2f57d1b96aa2c3beeaa4e84d33703504bbccef86097f099bea22370c4863593659e4db0384b6449e72babf52adec85d75fd7ba638e774a4d9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53f78ace3b6b796be869b923de1e61b8a
SHA165e72a315eb1a2811f83e1588db6f780d6d1ad60
SHA2560d94ca009e2de413cab365712c405aa046484e7bfbd8bf10a303dc8ae695f155
SHA512946465357ad48dca5b778bf1f109e8eb4f7fdc914ab8806af1ab1e7ba10c230e5c672735f81ad97e769db839f51d4e77d0616ed612e9363dcdb22e2153c97073
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5772bc0221e74e3d68b2dcd5b2de997cd
SHA11f46cfe95ead435dbf6c95278b7e356731d60a53
SHA256554f6066fb131ea9a0a9df57a4717866c069dde05d2bf30168416bea67d532a5
SHA512c47561a21b8fc5f57c611ea600cd3c452aeb284bdc784301719e4aeee76b30e1001dc3ca49d317ca941abd468a67136fdd31bc8c3d53f319e6e679cf4b652594
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5f9c69e775782789a071258a77c9dc44f
SHA19ab93375475c4ed1c39538c4410013b2d0ea6955
SHA256d2f40aebc9c1aeba375a15d53e50b844e4c4532ebc3d2950a9177dfbc96263f3
SHA512405c403bc631e41d3a0795aa17c48d39cb0fb7ea4c7e5567b594ce165322480f92b54cb9ee1f2fe77c2f7343c2b3538747d295384f11e6f63fd9840aa2c46e5b
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/228-108-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/228-1-0x0000000004610000-0x0000000004A10000-memory.dmpFilesize
4.0MB
-
memory/228-84-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/228-54-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/228-78-0x0000000004610000-0x0000000004A10000-memory.dmpFilesize
4.0MB
-
memory/228-79-0x0000000004A10000-0x00000000052FB000-memory.dmpFilesize
8.9MB
-
memory/228-3-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/228-2-0x0000000004A10000-0x00000000052FB000-memory.dmpFilesize
8.9MB
-
memory/372-237-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/372-231-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/372-226-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/860-96-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/860-97-0x0000000070C40000-0x0000000070F94000-memory.dmpFilesize
3.3MB
-
memory/1080-56-0x00000000056B0000-0x0000000005A04000-memory.dmpFilesize
3.3MB
-
memory/1080-80-0x0000000007220000-0x0000000007231000-memory.dmpFilesize
68KB
-
memory/1080-77-0x0000000006EF0000-0x0000000006F93000-memory.dmpFilesize
652KB
-
memory/1080-67-0x0000000071240000-0x0000000071594000-memory.dmpFilesize
3.3MB
-
memory/1080-66-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/1080-81-0x0000000007270000-0x0000000007284000-memory.dmpFilesize
80KB
-
memory/1096-121-0x0000000071240000-0x0000000071594000-memory.dmpFilesize
3.3MB
-
memory/1096-120-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/1536-232-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-242-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-245-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-248-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-239-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-236-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-211-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-230-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-251-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-254-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1536-219-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1812-194-0x00000000063D0000-0x0000000006724000-memory.dmpFilesize
3.3MB
-
memory/1812-199-0x00000000709E0000-0x0000000070A2C000-memory.dmpFilesize
304KB
-
memory/1812-200-0x0000000070B80000-0x0000000070ED4000-memory.dmpFilesize
3.3MB
-
memory/2084-166-0x00000000054C0000-0x0000000005814000-memory.dmpFilesize
3.3MB
-
memory/2084-186-0x0000000005970000-0x0000000005984000-memory.dmpFilesize
80KB
-
memory/2084-185-0x00000000070D0000-0x00000000070E1000-memory.dmpFilesize
68KB
-
memory/2084-184-0x0000000006DA0000-0x0000000006E43000-memory.dmpFilesize
652KB
-
memory/2084-174-0x0000000071190000-0x00000000714E4000-memory.dmpFilesize
3.3MB
-
memory/2084-173-0x00000000709E0000-0x0000000070A2C000-memory.dmpFilesize
304KB
-
memory/2084-172-0x00000000060C0000-0x000000000610C000-memory.dmpFilesize
304KB
-
memory/4108-228-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4108-223-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4320-149-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/4320-150-0x0000000071240000-0x0000000071594000-memory.dmpFilesize
3.3MB
-
memory/4928-50-0x00000000078F0000-0x00000000078F8000-memory.dmpFilesize
32KB
-
memory/4928-6-0x0000000005390000-0x00000000059B8000-memory.dmpFilesize
6.2MB
-
memory/4928-43-0x0000000074C20000-0x00000000753D0000-memory.dmpFilesize
7.7MB
-
memory/4928-30-0x0000000070AC0000-0x0000000070B0C000-memory.dmpFilesize
304KB
-
memory/4928-44-0x0000000007840000-0x000000000784A000-memory.dmpFilesize
40KB
-
memory/4928-45-0x0000000007900000-0x0000000007996000-memory.dmpFilesize
600KB
-
memory/4928-26-0x0000000007B90000-0x000000000820A000-memory.dmpFilesize
6.5MB
-
memory/4928-46-0x0000000007860000-0x0000000007871000-memory.dmpFilesize
68KB
-
memory/4928-47-0x00000000078A0000-0x00000000078AE000-memory.dmpFilesize
56KB
-
memory/4928-48-0x00000000078B0000-0x00000000078C4000-memory.dmpFilesize
80KB
-
memory/4928-31-0x0000000070C40000-0x0000000070F94000-memory.dmpFilesize
3.3MB
-
memory/4928-29-0x00000000076F0000-0x0000000007722000-memory.dmpFilesize
200KB
-
memory/4928-49-0x00000000079A0000-0x00000000079BA000-memory.dmpFilesize
104KB
-
memory/4928-42-0x0000000007750000-0x00000000077F3000-memory.dmpFilesize
652KB
-
memory/4928-4-0x0000000074C2E000-0x0000000074C2F000-memory.dmpFilesize
4KB
-
memory/4928-41-0x0000000007730000-0x000000000774E000-memory.dmpFilesize
120KB
-
memory/4928-28-0x0000000074C20000-0x00000000753D0000-memory.dmpFilesize
7.7MB
-
memory/4928-25-0x0000000007490000-0x0000000007506000-memory.dmpFilesize
472KB
-
memory/4928-5-0x0000000004BA0000-0x0000000004BD6000-memory.dmpFilesize
216KB
-
memory/4928-24-0x0000000006700000-0x0000000006744000-memory.dmpFilesize
272KB
-
memory/4928-53-0x0000000074C20000-0x00000000753D0000-memory.dmpFilesize
7.7MB
-
memory/4928-23-0x00000000061A0000-0x00000000061EC000-memory.dmpFilesize
304KB
-
memory/4928-22-0x0000000006150000-0x000000000616E000-memory.dmpFilesize
120KB
-
memory/4928-21-0x0000000005CA0000-0x0000000005FF4000-memory.dmpFilesize
3.3MB
-
memory/4928-11-0x0000000005B30000-0x0000000005B96000-memory.dmpFilesize
408KB
-
memory/4928-10-0x0000000005260000-0x00000000052C6000-memory.dmpFilesize
408KB
-
memory/4928-9-0x00000000051C0000-0x00000000051E2000-memory.dmpFilesize
136KB
-
memory/4928-8-0x0000000074C20000-0x00000000753D0000-memory.dmpFilesize
7.7MB
-
memory/4928-7-0x0000000074C20000-0x00000000753D0000-memory.dmpFilesize
7.7MB
-
memory/4928-27-0x0000000007530000-0x000000000754A000-memory.dmpFilesize
104KB
-
memory/5084-135-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/5084-107-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB