Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 16:45
Static task
static1
General
-
Target
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe
-
Size
4.2MB
-
MD5
646f1300eb8701b58948565ccee31937
-
SHA1
205b2b868b2b3ced2854781f71b454665fa01b98
-
SHA256
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a
-
SHA512
ff75b76f8cfb51fe799d7f6bfcf80b9c6e7bd993c09dc6a7febdf7fa402579fe538799dd961468c6d85131f02883687de7d6dd826c4266969aa47e4d41dca51d
-
SSDEEP
98304:4/5S+b1Z/p6oQSInErfLJd2o/OVdeUy7NtwR:4BnTENnKJ0ZVk1BtwR
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4680-134-0x0000000005100000-0x00000000059EB000-memory.dmp family_glupteba behavioral1/memory/4680-159-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/4680-174-0x0000000005100000-0x00000000059EB000-memory.dmp family_glupteba behavioral1/memory/4680-204-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/1336-233-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/1336-266-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-296-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-349-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-357-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-359-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-361-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-363-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-365-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-367-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-369-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-371-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba behavioral1/memory/2316-373-0x0000000000400000-0x00000000030D2000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 2316 csrss.exe 4828 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe -
Drops file in Windows directory 2 IoCs
Processes:
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exedescription ioc process File created C:\Windows\rss\csrss.exe e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe File opened for modification C:\Windows\rss e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3868 schtasks.exe 3268 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exee5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exepowershell.exee5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 1296 powershell.exe 1296 powershell.exe 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1624 powershell.exe 1624 powershell.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe 4420 powershell.exe 4420 powershell.exe 4608 powershell.exe 4608 powershell.exe 4288 powershell.exe 4288 powershell.exe 2236 powershell.exe 2236 powershell.exe 1036 powershell.exe 1036 powershell.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 2316 csrss.exe 2316 csrss.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 2316 csrss.exe 2316 csrss.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe 4828 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exee5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Token: SeImpersonatePrivilege 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 4288 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 1036 powershell.exe Token: SeSystemEnvironmentPrivilege 2316 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exee5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.execmd.execsrss.exedescription pid process target process PID 4680 wrote to memory of 1296 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 4680 wrote to memory of 1296 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 4680 wrote to memory of 1296 4680 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 1624 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 1624 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 1624 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 3776 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe cmd.exe PID 1336 wrote to memory of 3776 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe cmd.exe PID 3776 wrote to memory of 3364 3776 cmd.exe netsh.exe PID 3776 wrote to memory of 3364 3776 cmd.exe netsh.exe PID 1336 wrote to memory of 4420 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 4420 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 4420 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 4608 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 4608 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 4608 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe powershell.exe PID 1336 wrote to memory of 2316 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe csrss.exe PID 1336 wrote to memory of 2316 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe csrss.exe PID 1336 wrote to memory of 2316 1336 e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe csrss.exe PID 2316 wrote to memory of 4288 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 4288 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 4288 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 2236 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 2236 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 2236 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 1036 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 1036 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 1036 2316 csrss.exe powershell.exe PID 2316 wrote to memory of 4828 2316 csrss.exe injector.exe PID 2316 wrote to memory of 4828 2316 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe"C:\Users\Admin\AppData\Local\Temp\e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe"C:\Users\Admin\AppData\Local\Temp\e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sapldi0n.rcr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e305af83bd866be257e45ad514ec188a
SHA167ce9259bc2a60bdf6ca5ba1c366257f491c278d
SHA256552ed0150942cbe90c057a9e3aa0098287f1cb5d2b36779aab71e6a6bbac21cd
SHA51239de10477b91f6a1a18fb9bc1253037b27e2dde4bf1724098d9aee13f377b643395fa4e1c149a42a86cf41ed4fcdc01adba3b8a6e4e6e3d40e8811c2a6c1548d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e4bcd3572ca64bfdfcd5eb0b699ccb69
SHA13985a5f6863f4bc04de68e10ef3d0787b8505ce3
SHA256a0cce16114c43743938af2dd52a6f7c7997851cb36d34c5530bc59e6b592a607
SHA5122b60917ca6577c99141d75dfc2606785c9a754fdab1c176fbe9be7c71a86dd84f31cdb57c6a81588704692e7a1f0ad89da407151cfdc4dc36283cd37379a9e74
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5465dae2b90bbed6c7f528e83e9dc53c1
SHA156c7c270a271130d19f6c40d1b727817e5051f06
SHA256774181649ccfe6b6efbacf472750fc9d70ee8a418c8db51f3e549d7b47086fdf
SHA512db0ee01807d55606f830fcda87072a50dccd260f214a874f76e849cf327c1f46106a3e7f1df17627a4810d4fe6d4b0bbee2535790cc4c78821c363ae7ef45d80
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD514dd042a4f784c90dea6a9ba380bd7d0
SHA12cf76c42b6ddf818dbf012c329a1598ee56cb0f5
SHA2569dc8d3629c80f197ecf138aba970b90cfdb69852e333e48113906a6c0ed895ba
SHA51220e6e97b0a596401e1a5c84203b5ea02194c90ea7caa4b80af35084ea76a53d4d4e9150813d6925c62895de0ac8b9d0ac6e2419384891ea6f8d380e6adf83f2f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e37f1884281fd0d883d8cdff90d3f285
SHA1ca7c234e8deb3bd3efe9719a94ea35b9f50e3b81
SHA25696aea3fb32f3c451008ccb1c2f8d9d84e4e75529a9e1cee972944ac81f1cc6e8
SHA5124cf0f2d10fe4b8d3a7d0beeecd9d5ca68c579060547c53aab64ab13219419e51c6258c4c97a437479abf57167478401c7f7ecedf06ac1e7085e0572640910653
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5646f1300eb8701b58948565ccee31937
SHA1205b2b868b2b3ced2854781f71b454665fa01b98
SHA256e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a
SHA512ff75b76f8cfb51fe799d7f6bfcf80b9c6e7bd993c09dc6a7febdf7fa402579fe538799dd961468c6d85131f02883687de7d6dd826c4266969aa47e4d41dca51d
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5646f1300eb8701b58948565ccee31937
SHA1205b2b868b2b3ced2854781f71b454665fa01b98
SHA256e5321e8a00e9cb234a20ef45309620c31b2d686ecd80eabad23932bcfe9ffe5a
SHA512ff75b76f8cfb51fe799d7f6bfcf80b9c6e7bd993c09dc6a7febdf7fa402579fe538799dd961468c6d85131f02883687de7d6dd826c4266969aa47e4d41dca51d
-
memory/1036-334-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/1036-336-0x0000000070650000-0x000000007069C000-memory.dmpFilesize
304KB
-
memory/1036-335-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/1036-337-0x00000000707D0000-0x0000000070B24000-memory.dmpFilesize
3.3MB
-
memory/1036-347-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/1036-348-0x000000007F640000-0x000000007F650000-memory.dmpFilesize
64KB
-
memory/1296-154-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/1296-141-0x0000000005760000-0x00000000057C6000-memory.dmpFilesize
408KB
-
memory/1296-171-0x00000000074C0000-0x00000000074CA000-memory.dmpFilesize
40KB
-
memory/1296-160-0x00000000708B0000-0x0000000070C04000-memory.dmpFilesize
3.3MB
-
memory/1296-172-0x000000007FDE0000-0x000000007FDF0000-memory.dmpFilesize
64KB
-
memory/1296-173-0x0000000007580000-0x0000000007616000-memory.dmpFilesize
600KB
-
memory/1296-158-0x0000000070730000-0x000000007077C000-memory.dmpFilesize
304KB
-
memory/1296-175-0x0000000007530000-0x000000000753E000-memory.dmpFilesize
56KB
-
memory/1296-176-0x0000000007620000-0x000000000763A000-memory.dmpFilesize
104KB
-
memory/1296-177-0x0000000007570000-0x0000000007578000-memory.dmpFilesize
32KB
-
memory/1296-135-0x0000000004850000-0x0000000004886000-memory.dmpFilesize
216KB
-
memory/1296-136-0x0000000004FE0000-0x0000000005608000-memory.dmpFilesize
6.2MB
-
memory/1296-137-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/1296-138-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/1296-139-0x0000000004E50000-0x0000000004E72000-memory.dmpFilesize
136KB
-
memory/1296-140-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/1296-157-0x0000000007390000-0x00000000073C2000-memory.dmpFilesize
200KB
-
memory/1296-156-0x00000000071D0000-0x00000000071EA000-memory.dmpFilesize
104KB
-
memory/1296-155-0x0000000007830000-0x0000000007EAA000-memory.dmpFilesize
6.5MB
-
memory/1296-153-0x0000000007130000-0x00000000071A6000-memory.dmpFilesize
472KB
-
memory/1296-152-0x0000000006380000-0x00000000063C4000-memory.dmpFilesize
272KB
-
memory/1296-151-0x0000000005E20000-0x0000000005E3E000-memory.dmpFilesize
120KB
-
memory/1296-170-0x0000000007370000-0x000000000738E000-memory.dmpFilesize
120KB
-
memory/1336-233-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/1336-266-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/1624-205-0x000000007FAE0000-0x000000007FAF0000-memory.dmpFilesize
64KB
-
memory/1624-194-0x0000000070EB0000-0x0000000071204000-memory.dmpFilesize
3.3MB
-
memory/1624-193-0x0000000070730000-0x000000007077C000-memory.dmpFilesize
304KB
-
memory/1624-192-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/1624-191-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/1624-181-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/2236-298-0x0000000005210000-0x0000000005220000-memory.dmpFilesize
64KB
-
memory/2236-297-0x0000000005210000-0x0000000005220000-memory.dmpFilesize
64KB
-
memory/2236-309-0x0000000070650000-0x000000007069C000-memory.dmpFilesize
304KB
-
memory/2236-320-0x0000000005210000-0x0000000005220000-memory.dmpFilesize
64KB
-
memory/2236-321-0x000000007F3D0000-0x000000007F3E0000-memory.dmpFilesize
64KB
-
memory/2236-310-0x00000000707F0000-0x0000000070B44000-memory.dmpFilesize
3.3MB
-
memory/2316-367-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-363-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-361-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-359-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-357-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-349-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-296-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-365-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-369-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-371-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/2316-373-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/4288-284-0x00000000708B0000-0x0000000070C04000-memory.dmpFilesize
3.3MB
-
memory/4288-283-0x0000000070730000-0x000000007077C000-memory.dmpFilesize
304KB
-
memory/4288-270-0x00000000028C0000-0x00000000028D0000-memory.dmpFilesize
64KB
-
memory/4288-271-0x00000000028C0000-0x00000000028D0000-memory.dmpFilesize
64KB
-
memory/4288-294-0x000000007F4C0000-0x000000007F4D0000-memory.dmpFilesize
64KB
-
memory/4288-282-0x00000000028C0000-0x00000000028D0000-memory.dmpFilesize
64KB
-
memory/4420-234-0x000000007F6C0000-0x000000007F6D0000-memory.dmpFilesize
64KB
-
memory/4420-223-0x0000000070EB0000-0x0000000071204000-memory.dmpFilesize
3.3MB
-
memory/4420-222-0x0000000070730000-0x000000007077C000-memory.dmpFilesize
304KB
-
memory/4420-221-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/4420-210-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/4420-209-0x0000000004D50000-0x0000000004D60000-memory.dmpFilesize
64KB
-
memory/4608-238-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/4608-261-0x000000007F170000-0x000000007F180000-memory.dmpFilesize
64KB
-
memory/4608-237-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/4608-249-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/4608-250-0x0000000070730000-0x000000007077C000-memory.dmpFilesize
304KB
-
memory/4608-251-0x00000000708B0000-0x0000000070C04000-memory.dmpFilesize
3.3MB
-
memory/4680-159-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/4680-174-0x0000000005100000-0x00000000059EB000-memory.dmpFilesize
8.9MB
-
memory/4680-204-0x0000000000400000-0x00000000030D2000-memory.dmpFilesize
44.8MB
-
memory/4680-134-0x0000000005100000-0x00000000059EB000-memory.dmpFilesize
8.9MB