Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 09:02
Static task
static1
Behavioral task
behavioral1
Sample
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe
Resource
win10v2004-20240508-en
General
-
Target
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe
-
Size
4.1MB
-
MD5
0b004bc3dda12c72e3fba5e88ff1e5b2
-
SHA1
80a435b54fded05c3f367aa80fc520410d8fa3b5
-
SHA256
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64
-
SHA512
06b8e14f6e44598ea51f8b82ec77808335d48f88dd59ef1c8b751b58430ff0478859834654e54bf3c4cfd7fad70238f620ea46d2b5cf2db204421737c3f069e2
-
SSDEEP
98304:4ErTbmYqgZ1XudKeC70JrifsEkbyxLCxltfr4Ppsv6xaCID:bD1Z1UwAUfrk2xOxPr4PpsvyaCID
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-2-0x0000000004980000-0x000000000526B000-memory.dmp family_glupteba behavioral1/memory/2036-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2036-54-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/2036-57-0x0000000004980000-0x000000000526B000-memory.dmp family_glupteba behavioral1/memory/2036-96-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3344-131-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/3344-136-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-218-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-229-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-231-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-234-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-237-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-240-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-243-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-246-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-249-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-252-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-255-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1908-258-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 844 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1908 csrss.exe 4864 injector.exe 2828 windefender.exe 3244 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/2828-223-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3244-226-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2828-228-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3244-232-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3244-238-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exe8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe -
Drops file in Windows directory 4 IoCs
Processes:
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3128 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3008 powershell.exe 4864 powershell.exe 4460 powershell.exe 2596 powershell.exe 4716 powershell.exe 1748 powershell.exe 5048 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3252 schtasks.exe 2172 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exepowershell.exe8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3008 powershell.exe 3008 powershell.exe 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 4864 powershell.exe 4864 powershell.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe 4460 powershell.exe 4460 powershell.exe 2596 powershell.exe 2596 powershell.exe 4716 powershell.exe 4716 powershell.exe 1748 powershell.exe 1748 powershell.exe 5048 powershell.exe 5048 powershell.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 1908 csrss.exe 1908 csrss.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 1908 csrss.exe 1908 csrss.exe 4864 injector.exe 4864 injector.exe 1908 csrss.exe 1908 csrss.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe 4864 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Token: SeImpersonatePrivilege 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeDebugPrivilege 2596 powershell.exe Token: SeDebugPrivilege 4716 powershell.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeSystemEnvironmentPrivilege 1908 csrss.exe Token: SeSecurityPrivilege 3128 sc.exe Token: SeSecurityPrivilege 3128 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 2036 wrote to memory of 3008 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 2036 wrote to memory of 3008 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 2036 wrote to memory of 3008 2036 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4864 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4864 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4864 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4580 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe cmd.exe PID 3344 wrote to memory of 4580 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe cmd.exe PID 4580 wrote to memory of 844 4580 cmd.exe netsh.exe PID 4580 wrote to memory of 844 4580 cmd.exe netsh.exe PID 3344 wrote to memory of 4460 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4460 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 4460 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 2596 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 2596 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 2596 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe powershell.exe PID 3344 wrote to memory of 1908 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe csrss.exe PID 3344 wrote to memory of 1908 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe csrss.exe PID 3344 wrote to memory of 1908 3344 8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe csrss.exe PID 1908 wrote to memory of 4716 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 4716 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 4716 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 1748 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 1748 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 1748 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 5048 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 5048 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 5048 1908 csrss.exe powershell.exe PID 1908 wrote to memory of 4864 1908 csrss.exe injector.exe PID 1908 wrote to memory of 4864 1908 csrss.exe injector.exe PID 2828 wrote to memory of 2916 2828 windefender.exe cmd.exe PID 2828 wrote to memory of 2916 2828 windefender.exe cmd.exe PID 2828 wrote to memory of 2916 2828 windefender.exe cmd.exe PID 2916 wrote to memory of 3128 2916 cmd.exe sc.exe PID 2916 wrote to memory of 3128 2916 cmd.exe sc.exe PID 2916 wrote to memory of 3128 2916 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe"C:\Users\Admin\AppData\Local\Temp\8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe"C:\Users\Admin\AppData\Local\Temp\8ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofy5iuzl.zwn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD507155bb274e51a6e99bf608fa56a6cfe
SHA1c93dd6a1bc9abdd09886a7e7f80fd63fe45ce010
SHA256cc1bf23d74bba46f0628158d2657dece062ba341d91d1261412ee9b3e9b9a8cc
SHA5123e5a4614f7c629cf1542885bef6d3aaae04662df158b7a3638d5e7495b245e9dd2d24fddaa173b1c2e7cfef758b31e9b9666e89dd868fac5b804285363ee5cd9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD585d9b547112b44e636cdc1bc2b928107
SHA186a38fddb426c4e825e38fc7bf053736bf7748de
SHA2561e52f16210f18a5915b8d6c04780da88b1a467ae37c27f8ffa22afd274d4092d
SHA5126c524a283623f4f60d2f201a5c34e4c527480b9e658954b37d7e2686d4feaa48985a8200add06be4e3071b42debb18566e2958ce8bcfbff9e78e79bb8364e925
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f97b3648f776734967a28048422ad8c9
SHA1bc884b53c1e79c21ac48013f217939a98c7b4cd5
SHA2569c714b6102f30f9b6a1f450b631f2d667d26f4a083cdb4e85f81d636c30d597e
SHA512d5b11703d7807b1ae0fc965508a01ee3c6defc28603df97f8f95c47c21ee17947fbf4ea63411208cfcbda286f48f0fa0502e1357cec1ec476306ce33fce40855
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e511b58e233b3c128f207cb0344c2d0d
SHA16e4f9bb0fe99f113d3cc7b4cd8721b7cdc68e513
SHA2566650fc395472197b0362439b64401f8941148aa3362b9301e5085d3e57deb22c
SHA5123c88d5583fab4865fe8b4393e3ae0b1eed0586af6600a3e72a4113ccbb325699175d1a8e44b3f93e985746f71ed24c6c1e019579092ec7663dedb8b2d9743757
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD597b1c71a58cb0b09889417548bff4002
SHA1dc0df51d81dc964093e8c3c44f4ef1c30221bf8c
SHA2567370f2764a0012fd76998a156169fc7e1fbcdebad11d109d76791227f23acfb7
SHA512a92c0d61f8278abe7ab9cac02e4e0505d6f0afa1f0eb5fd08fb86c6d8dd349cb145008d5956057b32e6c1f58ef0bf9bf371f49f8e26aa3b6b5b86b03b9b468ff
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD50b004bc3dda12c72e3fba5e88ff1e5b2
SHA180a435b54fded05c3f367aa80fc520410d8fa3b5
SHA2568ac77b0346213cd85babfd7ba2843b57d05ff710ea0faca597a96e48b17eaa64
SHA51206b8e14f6e44598ea51f8b82ec77808335d48f88dd59ef1c8b751b58430ff0478859834654e54bf3c4cfd7fad70238f620ea46d2b5cf2db204421737c3f069e2
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1748-188-0x0000000004F90000-0x0000000004FA4000-memory.dmpFilesize
80KB
-
memory/1748-186-0x0000000006EF0000-0x0000000006F93000-memory.dmpFilesize
652KB
-
memory/1748-172-0x0000000005770000-0x0000000005AC4000-memory.dmpFilesize
3.3MB
-
memory/1748-174-0x0000000005D20000-0x0000000005D6C000-memory.dmpFilesize
304KB
-
memory/1748-176-0x00000000704D0000-0x0000000070824000-memory.dmpFilesize
3.3MB
-
memory/1748-175-0x0000000070350000-0x000000007039C000-memory.dmpFilesize
304KB
-
memory/1748-187-0x0000000007210000-0x0000000007221000-memory.dmpFilesize
68KB
-
memory/1908-231-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-243-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-249-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-252-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-218-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-255-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-229-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-258-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-246-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-240-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-237-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1908-234-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/2036-96-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2036-3-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2036-1-0x0000000004570000-0x0000000004977000-memory.dmpFilesize
4.0MB
-
memory/2036-54-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/2036-56-0x0000000004570000-0x0000000004977000-memory.dmpFilesize
4.0MB
-
memory/2036-57-0x0000000004980000-0x000000000526B000-memory.dmpFilesize
8.9MB
-
memory/2036-2-0x0000000004980000-0x000000000526B000-memory.dmpFilesize
8.9MB
-
memory/2596-117-0x0000000005D50000-0x00000000060A4000-memory.dmpFilesize
3.3MB
-
memory/2596-119-0x0000000070430000-0x000000007047C000-memory.dmpFilesize
304KB
-
memory/2596-120-0x00000000705D0000-0x0000000070924000-memory.dmpFilesize
3.3MB
-
memory/2828-228-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2828-223-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3008-44-0x0000000007CB0000-0x0000000007CBA000-memory.dmpFilesize
40KB
-
memory/3008-53-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/3008-11-0x0000000005FB0000-0x0000000006016000-memory.dmpFilesize
408KB
-
memory/3008-9-0x00000000055F0000-0x0000000005612000-memory.dmpFilesize
136KB
-
memory/3008-50-0x0000000007D60000-0x0000000007D68000-memory.dmpFilesize
32KB
-
memory/3008-49-0x0000000007E10000-0x0000000007E2A000-memory.dmpFilesize
104KB
-
memory/3008-48-0x0000000007D20000-0x0000000007D34000-memory.dmpFilesize
80KB
-
memory/3008-47-0x0000000007D10000-0x0000000007D1E000-memory.dmpFilesize
56KB
-
memory/3008-10-0x0000000005ED0000-0x0000000005F36000-memory.dmpFilesize
408KB
-
memory/3008-46-0x0000000007CD0000-0x0000000007CE1000-memory.dmpFilesize
68KB
-
memory/3008-45-0x0000000007D70000-0x0000000007E06000-memory.dmpFilesize
600KB
-
memory/3008-43-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/3008-6-0x00000000057A0000-0x0000000005DC8000-memory.dmpFilesize
6.2MB
-
memory/3008-42-0x0000000007BA0000-0x0000000007C43000-memory.dmpFilesize
652KB
-
memory/3008-8-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/3008-7-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/3008-31-0x0000000070BB0000-0x0000000070F04000-memory.dmpFilesize
3.3MB
-
memory/3008-41-0x0000000007B80000-0x0000000007B9E000-memory.dmpFilesize
120KB
-
memory/3008-30-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/3008-5-0x0000000002C80000-0x0000000002CB6000-memory.dmpFilesize
216KB
-
memory/3008-29-0x0000000070430000-0x000000007047C000-memory.dmpFilesize
304KB
-
memory/3008-28-0x0000000007B40000-0x0000000007B72000-memory.dmpFilesize
200KB
-
memory/3008-27-0x0000000007980000-0x000000000799A000-memory.dmpFilesize
104KB
-
memory/3008-26-0x0000000008000000-0x000000000867A000-memory.dmpFilesize
6.5MB
-
memory/3008-25-0x0000000007900000-0x0000000007976000-memory.dmpFilesize
472KB
-
memory/3008-24-0x0000000006B10000-0x0000000006B54000-memory.dmpFilesize
272KB
-
memory/3008-23-0x0000000006610000-0x000000000665C000-memory.dmpFilesize
304KB
-
memory/3008-4-0x000000007459E000-0x000000007459F000-memory.dmpFilesize
4KB
-
memory/3008-22-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/3008-21-0x0000000006020000-0x0000000006374000-memory.dmpFilesize
3.3MB
-
memory/3244-232-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3244-226-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3244-238-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3344-131-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/3344-136-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/4460-95-0x0000000070430000-0x000000007047C000-memory.dmpFilesize
304KB
-
memory/4460-97-0x0000000070BB0000-0x0000000070F04000-memory.dmpFilesize
3.3MB
-
memory/4716-151-0x00000000705B0000-0x0000000070904000-memory.dmpFilesize
3.3MB
-
memory/4716-148-0x0000000006480000-0x00000000067D4000-memory.dmpFilesize
3.3MB
-
memory/4716-150-0x0000000070430000-0x000000007047C000-memory.dmpFilesize
304KB
-
memory/4864-81-0x0000000007400000-0x0000000007414000-memory.dmpFilesize
80KB
-
memory/4864-80-0x00000000073B0000-0x00000000073C1000-memory.dmpFilesize
68KB
-
memory/4864-79-0x0000000007080000-0x0000000007123000-memory.dmpFilesize
652KB
-
memory/4864-69-0x0000000070830000-0x0000000070B84000-memory.dmpFilesize
3.3MB
-
memory/4864-68-0x0000000070430000-0x000000007047C000-memory.dmpFilesize
304KB
-
memory/4864-64-0x0000000005840000-0x0000000005B94000-memory.dmpFilesize
3.3MB
-
memory/5048-202-0x0000000070AE0000-0x0000000070E34000-memory.dmpFilesize
3.3MB
-
memory/5048-195-0x00000000058B0000-0x0000000005C04000-memory.dmpFilesize
3.3MB
-
memory/5048-201-0x0000000070350000-0x000000007039C000-memory.dmpFilesize
304KB