Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:25
Static task
static1
Behavioral task
behavioral1
Sample
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe
Resource
win10v2004-20240508-en
General
-
Target
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe
-
Size
4.1MB
-
MD5
bb9c2da9b21a68cea93f90e0d981f1dd
-
SHA1
77a6f7e50a734744220b170fcc9ffa26d90d3691
-
SHA256
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca
-
SHA512
b8d5c697da4741ac52df526ce7e5f44cb0057ae7655991a6aef5f6117b20fa2b5124518e525c9816f47512001304c49dac25cfab584eb4ab3521cd3db1854925
-
SSDEEP
98304:ValdxVYbeltggr6p7qKtgoJu9O6Qxc6qPeInuZKahKn+3QT:6xq6ggrt/os9O/WxuFhK+AT
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4252-2-0x00000000049A0000-0x000000000528B000-memory.dmp family_glupteba behavioral1/memory/4252-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4252-54-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/4252-79-0x00000000049A0000-0x000000000528B000-memory.dmp family_glupteba behavioral1/memory/4252-130-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1860-129-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1860-199-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-212-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-220-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-231-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-235-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-239-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-243-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-247-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-251-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-255-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-259-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-263-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral1/memory/1776-267-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4996 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 1776 csrss.exe 2288 injector.exe 5112 windefender.exe 4476 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/5112-224-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4476-227-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/5112-228-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4476-232-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4476-240-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe File created C:\Windows\rss\csrss.exe 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3240 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4240 powershell.exe 3608 powershell.exe 4988 powershell.exe 4528 powershell.exe 1100 powershell.exe 1852 powershell.exe 984 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4284 schtasks.exe 4832 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exepowershell.exe89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4240 powershell.exe 4240 powershell.exe 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 3608 powershell.exe 3608 powershell.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe 4988 powershell.exe 4988 powershell.exe 4528 powershell.exe 4528 powershell.exe 1100 powershell.exe 1100 powershell.exe 1852 powershell.exe 1852 powershell.exe 984 powershell.exe 984 powershell.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 1776 csrss.exe 1776 csrss.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 1776 csrss.exe 1776 csrss.exe 2288 injector.exe 2288 injector.exe 1776 csrss.exe 1776 csrss.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe 2288 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Token: SeImpersonatePrivilege 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe Token: SeDebugPrivilege 3608 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 4528 powershell.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeDebugPrivilege 1852 powershell.exe Token: SeDebugPrivilege 984 powershell.exe Token: SeSystemEnvironmentPrivilege 1776 csrss.exe Token: SeSecurityPrivilege 3240 sc.exe Token: SeSecurityPrivilege 3240 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4252 wrote to memory of 4240 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 4252 wrote to memory of 4240 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 4252 wrote to memory of 4240 4252 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 3608 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 3608 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 3608 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 324 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe cmd.exe PID 1860 wrote to memory of 324 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe cmd.exe PID 324 wrote to memory of 4996 324 cmd.exe netsh.exe PID 324 wrote to memory of 4996 324 cmd.exe netsh.exe PID 1860 wrote to memory of 4988 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 4988 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 4988 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 4528 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 4528 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 4528 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe powershell.exe PID 1860 wrote to memory of 1776 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe csrss.exe PID 1860 wrote to memory of 1776 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe csrss.exe PID 1860 wrote to memory of 1776 1860 89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe csrss.exe PID 1776 wrote to memory of 1100 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 1100 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 1100 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 1852 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 1852 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 1852 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 984 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 984 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 984 1776 csrss.exe powershell.exe PID 1776 wrote to memory of 2288 1776 csrss.exe injector.exe PID 1776 wrote to memory of 2288 1776 csrss.exe injector.exe PID 5112 wrote to memory of 3344 5112 windefender.exe cmd.exe PID 5112 wrote to memory of 3344 5112 windefender.exe cmd.exe PID 5112 wrote to memory of 3344 5112 windefender.exe cmd.exe PID 3344 wrote to memory of 3240 3344 cmd.exe sc.exe PID 3344 wrote to memory of 3240 3344 cmd.exe sc.exe PID 3344 wrote to memory of 3240 3344 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe"C:\Users\Admin\AppData\Local\Temp\89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe"C:\Users\Admin\AppData\Local\Temp\89caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kiob5yjv.43i.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD59708510aa485c67c9f7ad09c072fa93c
SHA1158b5d57d5d4629664fbb23ff75e1abc3b816505
SHA25626cde8ed688d4a7d1d0aec9d3a01953dd2217dd6232aea786209a97e67134dbf
SHA512db02861093a688949e6d289b51017ae72cb005cccc58f750c401d6bf6977f22be55c79065606386ac113d43ba533986a3c9c754cabc541e1700a0b61ed183418
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c9cee74a5f0c0361f618b2783711d2a7
SHA1a35627152e62cfda8cdc2327b5bdc701de082235
SHA2561f9a638a5a3148d02db027d593ecbc472d88635fa67a2f1befd6a071f0f56463
SHA5120a8ed82b641cb0eb5f49e68ab897c23fcbc9222a05981fb2876c2517f8d3262b8bb0958cd22fa6aeaeb86b439b6938ca1e312124045a6d3e56fae5b0c8d95623
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b6e63419a9c7bb222c18fd245f21eaa5
SHA154cc98bb0fbddd0371a37dbd0dfb584509a887e2
SHA25603e069b762163dc7055885c7835014fa316c2f59c3d5b7c91a22a4a584c4171d
SHA512872266607f9da66ed6bbe041eadb05c389c5185e90c485eb07dbee1f83366e3804e350192f84bacebdd38a8f84fa07194642d26b8ac3ac1616ba235290fe16b3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f17f65773eb0811c7deae9cb5114d2ec
SHA1412513608fa642eba3badc706efa99933a953f69
SHA25658e1a2d0509b68e603ac7f43711b3453af66bdc8259b9272078582f50127b3e8
SHA5126da1db61587d28d4d6c5ebdfd0377f53a525b755903c37ef80249e6220e636a90dc611cc8fc62b897ab64723a8d3c0da9e06b1b5b6e6dc6816e4a5143402b6c6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52d34bd09f97b6947f478465d4faaaf4a
SHA11449bf588ebdafadf26e8e96e65a9ec6a8d73db9
SHA2568eec956e20fe3d8897880a6f7b2dd8dae730ab5089546a1849a2c5b18b889418
SHA512bc187619b899d3e72604941bb19d98edf64487c08fb5ccfcb8b2fe894d532c906f8651cc0fa1d2726bd2293ad146c27411d06d9ffc2147b7f26c74c09b09ad36
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5bb9c2da9b21a68cea93f90e0d981f1dd
SHA177a6f7e50a734744220b170fcc9ffa26d90d3691
SHA25689caa1ccff59ac365922bf9c5e204e8305c32af71d9aaf235ea245f11f0fc3ca
SHA512b8d5c697da4741ac52df526ce7e5f44cb0057ae7655991a6aef5f6117b20fa2b5124518e525c9816f47512001304c49dac25cfab584eb4ab3521cd3db1854925
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/984-200-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/984-201-0x00000000709F0000-0x0000000070D44000-memory.dmpFilesize
3.3MB
-
memory/984-192-0x00000000060A0000-0x00000000063F4000-memory.dmpFilesize
3.3MB
-
memory/1100-148-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/1100-146-0x0000000005980000-0x0000000005CD4000-memory.dmpFilesize
3.3MB
-
memory/1100-149-0x00000000704E0000-0x0000000070834000-memory.dmpFilesize
3.3MB
-
memory/1776-235-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-220-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-267-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-239-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-243-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-263-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-259-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-231-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-255-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-251-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-212-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1776-247-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1852-169-0x0000000005E50000-0x00000000061A4000-memory.dmpFilesize
3.3MB
-
memory/1852-185-0x00000000061D0000-0x00000000061E4000-memory.dmpFilesize
80KB
-
memory/1852-172-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/1852-173-0x00000000703E0000-0x0000000070734000-memory.dmpFilesize
3.3MB
-
memory/1852-183-0x00000000075F0000-0x0000000007693000-memory.dmpFilesize
652KB
-
memory/1852-184-0x0000000007960000-0x0000000007971000-memory.dmpFilesize
68KB
-
memory/1852-171-0x0000000006410000-0x000000000645C000-memory.dmpFilesize
304KB
-
memory/1860-129-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/1860-199-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/3608-66-0x00000000704C0000-0x0000000070814000-memory.dmpFilesize
3.3MB
-
memory/3608-77-0x0000000007AA0000-0x0000000007AB1000-memory.dmpFilesize
68KB
-
memory/3608-76-0x0000000007790000-0x0000000007833000-memory.dmpFilesize
652KB
-
memory/3608-65-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/3608-80-0x0000000007AF0000-0x0000000007B04000-memory.dmpFilesize
80KB
-
memory/4240-30-0x00000000704C0000-0x0000000070814000-memory.dmpFilesize
3.3MB
-
memory/4240-29-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/4240-4-0x00000000744AE000-0x00000000744AF000-memory.dmpFilesize
4KB
-
memory/4240-5-0x0000000004850000-0x0000000004886000-memory.dmpFilesize
216KB
-
memory/4240-6-0x00000000744A0000-0x0000000074C50000-memory.dmpFilesize
7.7MB
-
memory/4240-7-0x0000000004EC0000-0x00000000054E8000-memory.dmpFilesize
6.2MB
-
memory/4240-8-0x00000000744A0000-0x0000000074C50000-memory.dmpFilesize
7.7MB
-
memory/4240-9-0x0000000004E40000-0x0000000004E62000-memory.dmpFilesize
136KB
-
memory/4240-11-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/4240-10-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/4240-53-0x00000000744A0000-0x0000000074C50000-memory.dmpFilesize
7.7MB
-
memory/4240-50-0x0000000007590000-0x0000000007598000-memory.dmpFilesize
32KB
-
memory/4240-49-0x0000000007640000-0x000000000765A000-memory.dmpFilesize
104KB
-
memory/4240-48-0x0000000007550000-0x0000000007564000-memory.dmpFilesize
80KB
-
memory/4240-47-0x0000000007540000-0x000000000754E000-memory.dmpFilesize
56KB
-
memory/4240-46-0x0000000007500000-0x0000000007511000-memory.dmpFilesize
68KB
-
memory/4240-45-0x00000000075A0000-0x0000000007636000-memory.dmpFilesize
600KB
-
memory/4240-44-0x00000000074E0000-0x00000000074EA000-memory.dmpFilesize
40KB
-
memory/4240-42-0x00000000744A0000-0x0000000074C50000-memory.dmpFilesize
7.7MB
-
memory/4240-43-0x00000000073D0000-0x0000000007473000-memory.dmpFilesize
652KB
-
memory/4240-41-0x00000000073B0000-0x00000000073CE000-memory.dmpFilesize
120KB
-
memory/4240-21-0x0000000005930000-0x0000000005C84000-memory.dmpFilesize
3.3MB
-
memory/4240-31-0x00000000744A0000-0x0000000074C50000-memory.dmpFilesize
7.7MB
-
memory/4240-22-0x0000000005DF0000-0x0000000005E0E000-memory.dmpFilesize
120KB
-
memory/4240-28-0x0000000007370000-0x00000000073A2000-memory.dmpFilesize
200KB
-
memory/4240-27-0x00000000071B0000-0x00000000071CA000-memory.dmpFilesize
104KB
-
memory/4240-26-0x0000000007810000-0x0000000007E8A000-memory.dmpFilesize
6.5MB
-
memory/4240-25-0x0000000007110000-0x0000000007186000-memory.dmpFilesize
472KB
-
memory/4240-24-0x0000000006F20000-0x0000000006F64000-memory.dmpFilesize
272KB
-
memory/4240-23-0x0000000005E30000-0x0000000005E7C000-memory.dmpFilesize
304KB
-
memory/4252-78-0x00000000045A0000-0x000000000499C000-memory.dmpFilesize
4.0MB
-
memory/4252-1-0x00000000045A0000-0x000000000499C000-memory.dmpFilesize
4.0MB
-
memory/4252-2-0x00000000049A0000-0x000000000528B000-memory.dmpFilesize
8.9MB
-
memory/4252-3-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4252-54-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/4252-130-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4252-79-0x00000000049A0000-0x000000000528B000-memory.dmpFilesize
8.9MB
-
memory/4476-227-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4476-232-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4476-240-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4528-106-0x00000000060D0000-0x0000000006424000-memory.dmpFilesize
3.3MB
-
memory/4528-118-0x0000000070AC0000-0x0000000070E14000-memory.dmpFilesize
3.3MB
-
memory/4528-117-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/4988-95-0x00000000704C0000-0x0000000070814000-memory.dmpFilesize
3.3MB
-
memory/4988-94-0x0000000070340000-0x000000007038C000-memory.dmpFilesize
304KB
-
memory/5112-228-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5112-224-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB