Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 23:18
Static task
static1
Behavioral task
behavioral1
Sample
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe
Resource
win7-20230220-en
General
-
Target
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe
-
Size
4.2MB
-
MD5
107771e54b6c360a17b74bf24bec21c7
-
SHA1
3384867612d93d664b520045ebb72d5b5778e15c
-
SHA256
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b
-
SHA512
901e762af384101b05ce2ab51510c22d1929d8767595e5348e0c19e5ee071c8be41d7e64bcb73bbd14965dbc869e16e3301dcaa1c50703551f37f13aa1844ff2
-
SSDEEP
98304:VlcsYGV7HHPXsdrn5v4SEQsbJ9fFJJ39Q7cd673xGqEJG1m:VSsYGpHyr5zgfJbQ7BjO
Malware Config
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-134-0x0000000002D90000-0x000000000367B000-memory.dmp family_glupteba behavioral2/memory/4616-160-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4616-204-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4648-218-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4648-264-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-317-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-353-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-355-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-357-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-359-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-361-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-363-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-365-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-367-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-369-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/948-371-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 948 csrss.exe 2328 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exe75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe -
Drops file in Windows directory 2 IoCs
Processes:
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exedescription ioc process File opened for modification C:\Windows\rss 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe File created C:\Windows\rss\csrss.exe 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1600 schtasks.exe 4684 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exepowershell.exe75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 2144 powershell.exe 2144 powershell.exe 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 1488 powershell.exe 1488 powershell.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe 4724 powershell.exe 4724 powershell.exe 4260 powershell.exe 4260 powershell.exe 372 powershell.exe 372 powershell.exe 3784 powershell.exe 3784 powershell.exe 4100 powershell.exe 4100 powershell.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 948 csrss.exe 948 csrss.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 948 csrss.exe 948 csrss.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe 2328 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exe75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 2144 powershell.exe Token: SeDebugPrivilege 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Token: SeImpersonatePrivilege 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeDebugPrivilege 372 powershell.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeDebugPrivilege 4100 powershell.exe Token: SeSystemEnvironmentPrivilege 948 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.execmd.execsrss.exedescription pid process target process PID 4616 wrote to memory of 2144 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4616 wrote to memory of 2144 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4616 wrote to memory of 2144 4616 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 1488 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 1488 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 1488 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 840 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe cmd.exe PID 4648 wrote to memory of 840 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe cmd.exe PID 840 wrote to memory of 1088 840 cmd.exe netsh.exe PID 840 wrote to memory of 1088 840 cmd.exe netsh.exe PID 4648 wrote to memory of 4724 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 4724 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 4724 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 4260 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 4260 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 4260 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe powershell.exe PID 4648 wrote to memory of 948 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe csrss.exe PID 4648 wrote to memory of 948 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe csrss.exe PID 4648 wrote to memory of 948 4648 75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe csrss.exe PID 948 wrote to memory of 372 948 csrss.exe powershell.exe PID 948 wrote to memory of 372 948 csrss.exe powershell.exe PID 948 wrote to memory of 372 948 csrss.exe powershell.exe PID 948 wrote to memory of 3784 948 csrss.exe powershell.exe PID 948 wrote to memory of 3784 948 csrss.exe powershell.exe PID 948 wrote to memory of 3784 948 csrss.exe powershell.exe PID 948 wrote to memory of 4100 948 csrss.exe powershell.exe PID 948 wrote to memory of 4100 948 csrss.exe powershell.exe PID 948 wrote to memory of 4100 948 csrss.exe powershell.exe PID 948 wrote to memory of 2328 948 csrss.exe injector.exe PID 948 wrote to memory of 2328 948 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe"C:\Users\Admin\AppData\Local\Temp\75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe"C:\Users\Admin\AppData\Local\Temp\75b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20jcfz5x.jde.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c7eb4bc97d5d7199f47ae933a8b18d6e
SHA1afe61abb4552850fff59d866f076506456e6d5e3
SHA25622cb5e708ef7af0a5971f38d027fa4e0f315307abbb8ecf0b9cb575661d1ee67
SHA512057818b6fd4a3f7a4cbdcd7e1886671f9c4814f2d51ba36c9644508ed7f288000d370f420625cd49635fa6b2305e170a10e82ce193c313e7b1c8e41735527224
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a9e3fa0c56c9a109aed901680df40c7a
SHA118a36c22f8f5569428209b61795bf09673adbd47
SHA256b585dae3c6fbb625b0b3add254b76990385c714529a017e28f6626ac12a4b455
SHA5124ab1dc00215a04d40baf44486efb1b378523cfa44fd4dcc5f6eab0a7a3cd6a938681015434def6cba61a9accb98f14c10f3ecf523ca381d37a4c7de017ef2a3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5eca1b122d5272dac10bf3afdd00cf6bb
SHA1d7464264e94871a2ea241c43db1f79be7def1fb5
SHA256c3eee88f2b53c796c5ef13e9985ef457492a711511abab947690a6d0e8f206c3
SHA5121d7bdb951dbbd270bf8ef37f70e0ed5ef8ef6f6c9b4432a42f79cab5dd0bb72e6094dee3dccd575152a0fea9e9ea763e2cbe6ae409f2641c25f695d11651180e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5cc7a83825793fc760b41598c2c2939e1
SHA18a7b0e623f3720f25a7028b687787e8c6dfb3b41
SHA2563b400dc78d2162ceebbbf10ee06a9ced681204cc3334e8c6075d8934b14df947
SHA512003249e7aac0b5e0208306c226faebec4e626b6690bbcb7e03be7c7750caf80c94445c5c3781ac61361fbb134d1dfee4c860334e20c303bfd93e799e95637bdd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e333201d3cf33468663bc1ac6824982a
SHA17c4fe2dfdb6b8e45651aa04e0b5eeef1762be8b9
SHA256132feaaa552512c65f7d1d0217b62bb430b4da8aa91762761d05becfc98042ec
SHA51232737d5c87b1e44b9799b37cb2b6504cd418c51fd1dbec096ce12b5247d2029eadec1263d8128b431fe67256064b6795ed59a3dbdc4c773bca7cbf6325b92930
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5107771e54b6c360a17b74bf24bec21c7
SHA13384867612d93d664b520045ebb72d5b5778e15c
SHA25675b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b
SHA512901e762af384101b05ce2ab51510c22d1929d8767595e5348e0c19e5ee071c8be41d7e64bcb73bbd14965dbc869e16e3301dcaa1c50703551f37f13aa1844ff2
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5107771e54b6c360a17b74bf24bec21c7
SHA13384867612d93d664b520045ebb72d5b5778e15c
SHA25675b5de04b6bacdb88bb58062c1a0ce1c407bdc97360d1709809e8a528ccfe06b
SHA512901e762af384101b05ce2ab51510c22d1929d8767595e5348e0c19e5ee071c8be41d7e64bcb73bbd14965dbc869e16e3301dcaa1c50703551f37f13aa1844ff2
-
memory/372-291-0x000000007F2B0000-0x000000007F2C0000-memory.dmpFilesize
64KB
-
memory/372-281-0x00000000713C0000-0x0000000071714000-memory.dmpFilesize
3.3MB
-
memory/372-276-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/372-277-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/372-279-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/372-280-0x0000000070C40000-0x0000000070C8C000-memory.dmpFilesize
304KB
-
memory/948-357-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-355-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-359-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-371-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-361-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-363-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-365-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-367-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-353-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-317-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/948-369-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/1488-191-0x0000000070C40000-0x0000000070C8C000-memory.dmpFilesize
304KB
-
memory/1488-192-0x00000000713C0000-0x0000000071714000-memory.dmpFilesize
3.3MB
-
memory/1488-193-0x00000000045D0000-0x00000000045E0000-memory.dmpFilesize
64KB
-
memory/1488-203-0x000000007F600000-0x000000007F610000-memory.dmpFilesize
64KB
-
memory/1488-190-0x00000000045D0000-0x00000000045E0000-memory.dmpFilesize
64KB
-
memory/1488-189-0x00000000045D0000-0x00000000045E0000-memory.dmpFilesize
64KB
-
memory/2144-157-0x0000000007A70000-0x0000000007AA2000-memory.dmpFilesize
200KB
-
memory/2144-155-0x00000000078A0000-0x00000000078BA000-memory.dmpFilesize
104KB
-
memory/2144-174-0x0000000007C00000-0x0000000007C0E000-memory.dmpFilesize
56KB
-
memory/2144-173-0x0000000007C50000-0x0000000007CE6000-memory.dmpFilesize
600KB
-
memory/2144-172-0x0000000007B80000-0x0000000007B8A000-memory.dmpFilesize
40KB
-
memory/2144-170-0x0000000007A30000-0x0000000007A4E000-memory.dmpFilesize
120KB
-
memory/2144-171-0x000000007F5D0000-0x000000007F5E0000-memory.dmpFilesize
64KB
-
memory/2144-159-0x00000000711F0000-0x0000000071544000-memory.dmpFilesize
3.3MB
-
memory/2144-158-0x0000000070C40000-0x0000000070C8C000-memory.dmpFilesize
304KB
-
memory/2144-176-0x0000000007C40000-0x0000000007C48000-memory.dmpFilesize
32KB
-
memory/2144-156-0x0000000002EC0000-0x0000000002ED0000-memory.dmpFilesize
64KB
-
memory/2144-175-0x0000000007CF0000-0x0000000007D0A000-memory.dmpFilesize
104KB
-
memory/2144-154-0x0000000007F00000-0x000000000857A000-memory.dmpFilesize
6.5MB
-
memory/2144-153-0x0000000007800000-0x0000000007876000-memory.dmpFilesize
472KB
-
memory/2144-152-0x0000000006A70000-0x0000000006AB4000-memory.dmpFilesize
272KB
-
memory/2144-151-0x00000000064F0000-0x000000000650E000-memory.dmpFilesize
120KB
-
memory/2144-146-0x0000000002EC0000-0x0000000002ED0000-memory.dmpFilesize
64KB
-
memory/2144-140-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/2144-139-0x0000000005E20000-0x0000000005E86000-memory.dmpFilesize
408KB
-
memory/2144-138-0x0000000005520000-0x0000000005542000-memory.dmpFilesize
136KB
-
memory/2144-137-0x00000000055C0000-0x0000000005BE8000-memory.dmpFilesize
6.2MB
-
memory/2144-136-0x0000000002EC0000-0x0000000002ED0000-memory.dmpFilesize
64KB
-
memory/2144-135-0x0000000004F50000-0x0000000004F86000-memory.dmpFilesize
216KB
-
memory/3784-307-0x0000000070D00000-0x0000000071054000-memory.dmpFilesize
3.3MB
-
memory/3784-318-0x0000000004780000-0x0000000004790000-memory.dmpFilesize
64KB
-
memory/3784-304-0x0000000004780000-0x0000000004790000-memory.dmpFilesize
64KB
-
memory/3784-305-0x0000000004780000-0x0000000004790000-memory.dmpFilesize
64KB
-
memory/3784-306-0x0000000070B60000-0x0000000070BAC000-memory.dmpFilesize
304KB
-
memory/3784-319-0x000000007F0D0000-0x000000007F0E0000-memory.dmpFilesize
64KB
-
memory/4100-334-0x0000000070CE0000-0x0000000071034000-memory.dmpFilesize
3.3MB
-
memory/4100-333-0x0000000070B60000-0x0000000070BAC000-memory.dmpFilesize
304KB
-
memory/4100-345-0x000000007F1E0000-0x000000007F1F0000-memory.dmpFilesize
64KB
-
memory/4100-344-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/4100-331-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/4100-332-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/4260-246-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/4260-248-0x00000000713C0000-0x0000000071714000-memory.dmpFilesize
3.3MB
-
memory/4260-247-0x0000000070C40000-0x0000000070C8C000-memory.dmpFilesize
304KB
-
memory/4260-259-0x000000007F7B0000-0x000000007F7C0000-memory.dmpFilesize
64KB
-
memory/4260-235-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/4616-134-0x0000000002D90000-0x000000000367B000-memory.dmpFilesize
8.9MB
-
memory/4616-160-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4616-204-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4648-218-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4648-264-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4724-233-0x000000007F3A0000-0x000000007F3B0000-memory.dmpFilesize
64KB
-
memory/4724-220-0x00000000029A0000-0x00000000029B0000-memory.dmpFilesize
64KB
-
memory/4724-219-0x00000000029A0000-0x00000000029B0000-memory.dmpFilesize
64KB
-
memory/4724-221-0x00000000029A0000-0x00000000029B0000-memory.dmpFilesize
64KB
-
memory/4724-222-0x0000000070C40000-0x0000000070C8C000-memory.dmpFilesize
304KB
-
memory/4724-223-0x0000000070DE0000-0x0000000071134000-memory.dmpFilesize
3.3MB