Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 14:05
Static task
static1
Behavioral task
behavioral1
Sample
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe
Resource
win10v2004-20240412-en
General
-
Target
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe
-
Size
4.2MB
-
MD5
b2128cefe6a9d6678b19d9f3ad12284f
-
SHA1
987e368da9ff647e8675936d20a4d1c4704839a8
-
SHA256
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b
-
SHA512
3520921bb9a9054084f06799ae198ecbaf38a13fd0c476dbef8a292ce0043ede00c3cf2dc4e70c63a23368ffb50e42c45e3c283bd169391cc5e03c67890dea44
-
SSDEEP
98304:Lu15A1GiNRFuKfVvdEh8/k6ld6teGU//blllQO5EUt0+BFZRUpdVYG:LaARFuKJWhQkavn//blllQdNaFDGX5
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/888-2-0x0000000003E70000-0x000000000475B000-memory.dmp family_glupteba behavioral1/memory/888-3-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/3120-57-0x0000000003E70000-0x000000000475B000-memory.dmp family_glupteba behavioral1/memory/3120-58-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/888-74-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/3120-133-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/3120-232-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-255-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-265-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-269-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-273-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-277-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-281-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-285-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-289-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-293-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-297-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-301-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-305-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral1/memory/2504-309-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4336 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2504 csrss.exe 4944 injector.exe 4892 windefender.exe 216 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/4892-263-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/216-267-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/216-275-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exee2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe -
Drops file in Windows directory 4 IoCs
Processes:
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4776 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1776 schtasks.exe 1648 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exepowershell.exepowershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exee2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exepowershell.exee2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4048 powershell.exe 4048 powershell.exe 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 2804 powershell.exe 2804 powershell.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe 216 powershell.exe 216 powershell.exe 5028 powershell.exe 5028 powershell.exe 2520 powershell.exe 2520 powershell.exe 1548 powershell.exe 1548 powershell.exe 3088 powershell.exe 3088 powershell.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 2504 csrss.exe 2504 csrss.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 2504 csrss.exe 2504 csrss.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 2504 csrss.exe 2504 csrss.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe 4944 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exee2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Token: SeImpersonatePrivilege 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 3088 powershell.exe Token: SeSystemEnvironmentPrivilege 2504 csrss.exe Token: SeSecurityPrivilege 4776 sc.exe Token: SeSecurityPrivilege 4776 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exee2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 888 wrote to memory of 4048 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 888 wrote to memory of 4048 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 888 wrote to memory of 4048 888 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 2804 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 2804 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 2804 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 3444 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe cmd.exe PID 3120 wrote to memory of 3444 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe cmd.exe PID 3444 wrote to memory of 4336 3444 cmd.exe netsh.exe PID 3444 wrote to memory of 4336 3444 cmd.exe netsh.exe PID 3120 wrote to memory of 216 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 216 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 216 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 5028 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 5028 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 5028 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe powershell.exe PID 3120 wrote to memory of 2504 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe csrss.exe PID 3120 wrote to memory of 2504 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe csrss.exe PID 3120 wrote to memory of 2504 3120 e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe csrss.exe PID 2504 wrote to memory of 2520 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 2520 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 2520 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 1548 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 1548 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 1548 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 3088 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 3088 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 3088 2504 csrss.exe powershell.exe PID 2504 wrote to memory of 4944 2504 csrss.exe injector.exe PID 2504 wrote to memory of 4944 2504 csrss.exe injector.exe PID 4892 wrote to memory of 3924 4892 windefender.exe cmd.exe PID 4892 wrote to memory of 3924 4892 windefender.exe cmd.exe PID 4892 wrote to memory of 3924 4892 windefender.exe cmd.exe PID 3924 wrote to memory of 4776 3924 cmd.exe sc.exe PID 3924 wrote to memory of 4776 3924 cmd.exe sc.exe PID 3924 wrote to memory of 4776 3924 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe"C:\Users\Admin\AppData\Local\Temp\e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe"C:\Users\Admin\AppData\Local\Temp\e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yv4pquj4.aqf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD572ed851fd5d3fd16d7a8b52351e0c76d
SHA1c8b6f3b5e674d6854b552576cd105171ab948eb8
SHA256d4065bf99e46338ff5ec369e644c91dcb66837f5ad507c1ddf2328398de0f6be
SHA512c9d6102927366591efbca2292789eee22e31e02d98c439ace568e45d3c5a940f3d22241a76ba3ba37f2737d92858923544058e60302a1f2b7b8f04481e2e623c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e865f5ef41abb1d80fbabcad85e778e4
SHA1135fe5ce8fc6009b18e59375b15e0951220b637d
SHA25624b1a954cf8929916948bc8f943fb3af223740558b4737f8eda22fe503276730
SHA512319e6733bb53dafa7ac98ffc52e86ccec8c93a5a0ba213d3732844f08e2823b71327ea9f7c1556b64956ddf866233a48471804624f042ac1b0375869641eed62
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f284b240eba68c8f43d274be69004791
SHA151935bc4b75a1a1522e248bc61380e6a95b42d1d
SHA256d693183c6573176d6473b8c37aa736e4864f8eec5858dfdcebdb276f5d9b6bea
SHA512faa2ded595f5795c4c5e48ea51651c8aca4f4f85d0312d1afe15803c4290a92ffa41573dd3f8beb57eaaf734176a444fe930d7bfb9bc422ef2fe16afd68c9c2b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5cd90b34b90ff0edf16427e8202c2203f
SHA16a70d13fb7869e0b3354cf524fb55b13d8242d7b
SHA256ff3791ab82629acf20e2ab00401c76cfe035d4a23ef9ec5083e76b6cd0514b9f
SHA512e8f1d32a34bb401a0aace9445c3dd89baca8f5152eec73fc1749059b68c0f499c94433afc5f094661ba6955f3501c51595ee8c4ec28e5c16ecedf524327fc0cc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD544e1575d5b17c0c30bdf1d2f1763bd85
SHA1660643a11973443587ea1ffa38de8a8553f0eb94
SHA2567ffec0bc53b791912ad1c95f8605b95c6e85318baff6584a885c00ccc95efade
SHA5127131c7ecc991eb6ffdfc22ea30b5566ea21c231b78ac32693da98d003d752214ee018eb25e6cab68207d09cfafdaef6461a5c4961e222696bdbd1c97e5bd5438
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5b2128cefe6a9d6678b19d9f3ad12284f
SHA1987e368da9ff647e8675936d20a4d1c4704839a8
SHA256e2693272500a1df616b321f7a98380c4453dc03110df28c7fadc6ed4a9458d7b
SHA5123520921bb9a9054084f06799ae198ecbaf38a13fd0c476dbef8a292ce0043ede00c3cf2dc4e70c63a23368ffb50e42c45e3c283bd169391cc5e03c67890dea44
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/216-94-0x0000000000AA0000-0x0000000000AB0000-memory.dmpFilesize
64KB
-
memory/216-119-0x0000000000AA0000-0x0000000000AB0000-memory.dmpFilesize
64KB
-
memory/216-108-0x00000000712D0000-0x0000000071624000-memory.dmpFilesize
3.3MB
-
memory/216-275-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/216-106-0x000000007F2C0000-0x000000007F2D0000-memory.dmpFilesize
64KB
-
memory/216-107-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/216-267-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/216-96-0x00000000056B0000-0x0000000005A04000-memory.dmpFilesize
3.3MB
-
memory/216-93-0x0000000000AA0000-0x0000000000AB0000-memory.dmpFilesize
64KB
-
memory/216-121-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/216-92-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/888-74-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/888-1-0x0000000003A60000-0x0000000003E68000-memory.dmpFilesize
4.0MB
-
memory/888-56-0x0000000003A60000-0x0000000003E68000-memory.dmpFilesize
4.0MB
-
memory/888-3-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/888-2-0x0000000003E70000-0x000000000475B000-memory.dmpFilesize
8.9MB
-
memory/2504-273-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-285-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-309-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-255-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-265-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-305-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-269-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-277-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-301-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-281-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-297-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-293-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2504-289-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/2804-87-0x0000000007670000-0x0000000007684000-memory.dmpFilesize
80KB
-
memory/2804-59-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2804-71-0x0000000005CD0000-0x0000000006024000-memory.dmpFilesize
3.3MB
-
memory/2804-72-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/2804-73-0x0000000070CD0000-0x0000000071024000-memory.dmpFilesize
3.3MB
-
memory/2804-85-0x0000000007300000-0x00000000073A3000-memory.dmpFilesize
652KB
-
memory/2804-84-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2804-61-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2804-86-0x0000000007620000-0x0000000007631000-memory.dmpFilesize
68KB
-
memory/2804-60-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/2804-90-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/3120-232-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/3120-58-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/3120-57-0x0000000003E70000-0x000000000475B000-memory.dmpFilesize
8.9MB
-
memory/3120-55-0x0000000003A70000-0x0000000003E70000-memory.dmpFilesize
4.0MB
-
memory/3120-118-0x0000000003A70000-0x0000000003E70000-memory.dmpFilesize
4.0MB
-
memory/3120-133-0x0000000000400000-0x0000000001DFD000-memory.dmpFilesize
26.0MB
-
memory/4048-31-0x00000000712B0000-0x0000000071604000-memory.dmpFilesize
3.3MB
-
memory/4048-29-0x0000000007540000-0x0000000007572000-memory.dmpFilesize
200KB
-
memory/4048-50-0x0000000007730000-0x0000000007738000-memory.dmpFilesize
32KB
-
memory/4048-49-0x00000000077F0000-0x000000000780A000-memory.dmpFilesize
104KB
-
memory/4048-48-0x0000000007700000-0x0000000007714000-memory.dmpFilesize
80KB
-
memory/4048-47-0x00000000076F0000-0x00000000076FE000-memory.dmpFilesize
56KB
-
memory/4048-4-0x00000000029E0000-0x0000000002A16000-memory.dmpFilesize
216KB
-
memory/4048-5-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4048-46-0x00000000076B0000-0x00000000076C1000-memory.dmpFilesize
68KB
-
memory/4048-45-0x0000000007750000-0x00000000077E6000-memory.dmpFilesize
600KB
-
memory/4048-6-0x0000000002A40000-0x0000000002A50000-memory.dmpFilesize
64KB
-
memory/4048-7-0x0000000002A40000-0x0000000002A50000-memory.dmpFilesize
64KB
-
memory/4048-44-0x0000000007690000-0x000000000769A000-memory.dmpFilesize
40KB
-
memory/4048-41-0x0000000007580000-0x000000000759E000-memory.dmpFilesize
120KB
-
memory/4048-43-0x00000000075A0000-0x0000000007643000-memory.dmpFilesize
652KB
-
memory/4048-42-0x0000000002A40000-0x0000000002A50000-memory.dmpFilesize
64KB
-
memory/4048-30-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/4048-53-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4048-28-0x000000007F5A0000-0x000000007F5B0000-memory.dmpFilesize
64KB
-
memory/4048-27-0x0000000007390000-0x00000000073AA000-memory.dmpFilesize
104KB
-
memory/4048-8-0x0000000005100000-0x0000000005728000-memory.dmpFilesize
6.2MB
-
memory/4048-26-0x00000000079F0000-0x000000000806A000-memory.dmpFilesize
6.5MB
-
memory/4048-25-0x00000000072F0000-0x0000000007366000-memory.dmpFilesize
472KB
-
memory/4048-24-0x0000000006550000-0x0000000006594000-memory.dmpFilesize
272KB
-
memory/4048-23-0x0000000006060000-0x00000000060AC000-memory.dmpFilesize
304KB
-
memory/4048-22-0x0000000005FC0000-0x0000000005FDE000-memory.dmpFilesize
120KB
-
memory/4048-21-0x0000000005990000-0x0000000005CE4000-memory.dmpFilesize
3.3MB
-
memory/4048-10-0x0000000005080000-0x00000000050E6000-memory.dmpFilesize
408KB
-
memory/4048-11-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/4048-9-0x0000000004FE0000-0x0000000005002000-memory.dmpFilesize
136KB
-
memory/4892-263-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5028-135-0x000000007FDC0000-0x000000007FDD0000-memory.dmpFilesize
64KB
-
memory/5028-136-0x0000000070B50000-0x0000000070B9C000-memory.dmpFilesize
304KB
-
memory/5028-122-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/5028-123-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB