Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 20:40
Static task
static1
Behavioral task
behavioral1
Sample
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe
Resource
win10v2004-20240412-en
General
-
Target
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe
-
Size
4.2MB
-
MD5
1d849dcac4c72899b6a7e8d37a9d6799
-
SHA1
a077e05ea105807bede4e48e26c454d3112f2f25
-
SHA256
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23
-
SHA512
c10e22547b322cac4fa0f044597688993a3906623ca32c340a38eada0ed8cfdd6f4ec9141c0be62bbb75e64d2775151f60b408b3fba44796b14591bb6d2ba281
-
SSDEEP
98304:rVFRqPMdPA984H0WMAw6acMgLNchhd+W2lPIIo31xn1vrLR/3Lz6:RFYkS+E0uawLNQ+/9Bo7/q
Malware Config
Signatures
-
Glupteba payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1872-2-0x0000000003F40000-0x000000000482B000-memory.dmp family_glupteba behavioral1/memory/1872-3-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/1836-56-0x0000000003F50000-0x000000000483B000-memory.dmp family_glupteba behavioral1/memory/1836-58-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/1872-59-0x0000000003F40000-0x000000000482B000-memory.dmp family_glupteba behavioral1/memory/1872-73-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/1836-188-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-257-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-267-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-270-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-274-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-278-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-282-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-286-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-291-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-295-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-299-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-303-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-306-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba behavioral1/memory/3588-310-0x0000000000400000-0x0000000001DFF000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1604 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 3588 csrss.exe 1844 injector.exe 1980 windefender.exe 1488 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/1980-266-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1488-271-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1488-279-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe File created C:\Windows\rss\csrss.exe b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4540 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5112 schtasks.exe 3100 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exewindefender.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exepowershell.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3676 powershell.exe 3676 powershell.exe 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 2940 powershell.exe 2940 powershell.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe 4488 powershell.exe 4488 powershell.exe 1304 powershell.exe 1304 powershell.exe 1052 powershell.exe 1052 powershell.exe 1052 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 1484 powershell.exe 1484 powershell.exe 1484 powershell.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 3588 csrss.exe 3588 csrss.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 3588 csrss.exe 3588 csrss.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 3588 csrss.exe 3588 csrss.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe 1844 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Token: SeImpersonatePrivilege 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 1052 powershell.exe Token: SeDebugPrivilege 3840 powershell.exe Token: SeDebugPrivilege 1484 powershell.exe Token: SeSystemEnvironmentPrivilege 3588 csrss.exe Token: SeSecurityPrivilege 4540 sc.exe Token: SeSecurityPrivilege 4540 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exeb016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 1872 wrote to memory of 3676 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1872 wrote to memory of 3676 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1872 wrote to memory of 3676 1872 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 2940 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 2940 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 2940 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 2056 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe cmd.exe PID 1836 wrote to memory of 2056 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe cmd.exe PID 2056 wrote to memory of 1604 2056 cmd.exe netsh.exe PID 2056 wrote to memory of 1604 2056 cmd.exe netsh.exe PID 1836 wrote to memory of 4488 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 4488 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 4488 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 1304 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 1304 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 1304 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe powershell.exe PID 1836 wrote to memory of 3588 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe csrss.exe PID 1836 wrote to memory of 3588 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe csrss.exe PID 1836 wrote to memory of 3588 1836 b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe csrss.exe PID 3588 wrote to memory of 1052 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1052 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1052 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 3840 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 3840 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 3840 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1484 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1484 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1484 3588 csrss.exe powershell.exe PID 3588 wrote to memory of 1844 3588 csrss.exe injector.exe PID 3588 wrote to memory of 1844 3588 csrss.exe injector.exe PID 1980 wrote to memory of 4792 1980 windefender.exe cmd.exe PID 1980 wrote to memory of 4792 1980 windefender.exe cmd.exe PID 1980 wrote to memory of 4792 1980 windefender.exe cmd.exe PID 4792 wrote to memory of 4540 4792 cmd.exe sc.exe PID 4792 wrote to memory of 4540 4792 cmd.exe sc.exe PID 4792 wrote to memory of 4540 4792 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe"C:\Users\Admin\AppData\Local\Temp\b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe"C:\Users\Admin\AppData\Local\Temp\b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhmv413t.k5g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e2fbb079e49fc418a399fbd5d6f7615f
SHA1cf8802738ebc5ebb686b2d9bf56419a7820ac610
SHA256528057225151678fe8ea81cf4521437e30b7cb66fb54504ad9b2b54cf82e113b
SHA512bb89688abb29b2dd355228b8cb1af08ba26a1047bc4c2123b646e9fc59dada86eda88501f9e5a93ecb9a472f36a066cef06270e13791be99062a283ae001cab2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5494d0e6ce8752ab5e08a9884077c0de2
SHA18ed65158a0d4df6d068b4d095a4e972b4bfd3ae1
SHA2566148821eeb7ad8152f311b15198bcc4612e893bd51db71f4f03a5b4599c6edee
SHA5124eaef5b18dd6138ed3a6de276ecde3e9a9b6349f579f571fe4c1aa53f5564fbd2028524d63dc9277f467764a208dabf19bfb523608c21afcdb4c953eef1389bd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5294db29fac095f53c9348b411c664437
SHA15e09e730f57f1d3713181ff47b3982b8b02fe803
SHA256b24840c5260e36c2cd1e40485d22e39509a615f2ae6c5f5e658ecc48181e409d
SHA512078eb271fef117e769f38695d45a04f93f3323afe675ffae89eab606efc02d9fcb75d690657c9573f1104a7a05fc364794d2c21bfb451bb543a93f1f9fcf3ae1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5aca8b5f2b5b8c6b720b21e7b30ea4162
SHA11a9521dbcc75edc92fe4aa4e222e56fcb01a315f
SHA2569ccc576944ccb5d1c3a73fc49f7e2de182d92b9fd95be93b9297f1d75699dac7
SHA51299d9d6276c027c17150b3a85ea57da8bae20240bb3546ad0fc9bcc64b250b3c9ae9b653542a6d2be4b4ceb59d1eec4f7a3c429559822eccb9df98391174bdd44
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5af406a3500c13a5013a7093790675975
SHA10c10cfe8634775ca51f228d85c6a658e5e23c331
SHA256b5bc966ebcc1956fd05ff983f42b2ea9294b7c077905534bfbb3737038c01298
SHA5120c07541811f7723a5eab3dbe3851ec6d20c84e4a10128f1d18434638f07a3bea58d53f37e2ace6a3c8e270fef102501317411546fb6b13b60b728d3283d52362
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD51d849dcac4c72899b6a7e8d37a9d6799
SHA1a077e05ea105807bede4e48e26c454d3112f2f25
SHA256b016799bb90d37bd157c00415ab07ceba885bf7b234d42b1016ba913e3295b23
SHA512c10e22547b322cac4fa0f044597688993a3906623ca32c340a38eada0ed8cfdd6f4ec9141c0be62bbb75e64d2775151f60b408b3fba44796b14591bb6d2ba281
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1304-125-0x0000000004640000-0x0000000004650000-memory.dmpFilesize
64KB
-
memory/1304-126-0x0000000004640000-0x0000000004650000-memory.dmpFilesize
64KB
-
memory/1304-137-0x0000000070720000-0x000000007076C000-memory.dmpFilesize
304KB
-
memory/1304-124-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/1488-271-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1488-279-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1836-55-0x0000000003B40000-0x0000000003F45000-memory.dmpFilesize
4.0MB
-
memory/1836-58-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/1836-56-0x0000000003F50000-0x000000000483B000-memory.dmpFilesize
8.9MB
-
memory/1836-107-0x0000000003B40000-0x0000000003F45000-memory.dmpFilesize
4.0MB
-
memory/1836-188-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/1872-2-0x0000000003F40000-0x000000000482B000-memory.dmpFilesize
8.9MB
-
memory/1872-1-0x0000000003B30000-0x0000000003F32000-memory.dmpFilesize
4.0MB
-
memory/1872-73-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/1872-59-0x0000000003F40000-0x000000000482B000-memory.dmpFilesize
8.9MB
-
memory/1872-57-0x0000000003B30000-0x0000000003F32000-memory.dmpFilesize
4.0MB
-
memory/1872-3-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/1980-266-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2940-75-0x0000000070720000-0x000000007076C000-memory.dmpFilesize
304KB
-
memory/2940-86-0x0000000003070000-0x0000000003080000-memory.dmpFilesize
64KB
-
memory/2940-92-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/2940-89-0x0000000007BE0000-0x0000000007BF4000-memory.dmpFilesize
80KB
-
memory/2940-88-0x0000000007B90000-0x0000000007BA1000-memory.dmpFilesize
68KB
-
memory/2940-87-0x0000000007870000-0x0000000007913000-memory.dmpFilesize
652KB
-
memory/2940-76-0x0000000070EA0000-0x00000000711F4000-memory.dmpFilesize
3.3MB
-
memory/2940-74-0x000000007F9B0000-0x000000007F9C0000-memory.dmpFilesize
64KB
-
memory/2940-72-0x0000000006040000-0x0000000006394000-memory.dmpFilesize
3.3MB
-
memory/2940-62-0x0000000003070000-0x0000000003080000-memory.dmpFilesize
64KB
-
memory/2940-61-0x0000000003070000-0x0000000003080000-memory.dmpFilesize
64KB
-
memory/2940-60-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/3588-278-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-282-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-286-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-274-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-270-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-291-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-295-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-257-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-299-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-303-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-306-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-310-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3588-267-0x0000000000400000-0x0000000001DFF000-memory.dmpFilesize
26.0MB
-
memory/3676-9-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3676-8-0x0000000004F00000-0x0000000004F22000-memory.dmpFilesize
136KB
-
memory/3676-48-0x0000000007680000-0x0000000007694000-memory.dmpFilesize
80KB
-
memory/3676-30-0x0000000070720000-0x000000007076C000-memory.dmpFilesize
304KB
-
memory/3676-49-0x00000000076D0000-0x00000000076EA000-memory.dmpFilesize
104KB
-
memory/3676-28-0x000000007F4F0000-0x000000007F500000-memory.dmpFilesize
64KB
-
memory/3676-50-0x00000000076C0000-0x00000000076C8000-memory.dmpFilesize
32KB
-
memory/3676-53-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/3676-46-0x0000000007620000-0x0000000007631000-memory.dmpFilesize
68KB
-
memory/3676-45-0x0000000007720000-0x00000000077B6000-memory.dmpFilesize
600KB
-
memory/3676-27-0x0000000007300000-0x000000000731A000-memory.dmpFilesize
104KB
-
memory/3676-26-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/3676-25-0x0000000007060000-0x00000000070D6000-memory.dmpFilesize
472KB
-
memory/3676-24-0x00000000064B0000-0x00000000064F4000-memory.dmpFilesize
272KB
-
memory/3676-23-0x0000000005F80000-0x0000000005FCC000-memory.dmpFilesize
304KB
-
memory/3676-22-0x0000000005F40000-0x0000000005F5E000-memory.dmpFilesize
120KB
-
memory/3676-21-0x00000000058F0000-0x0000000005C44000-memory.dmpFilesize
3.3MB
-
memory/3676-11-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/3676-10-0x00000000050A0000-0x0000000005106000-memory.dmpFilesize
408KB
-
memory/3676-44-0x0000000007610000-0x000000000761A000-memory.dmpFilesize
40KB
-
memory/3676-47-0x0000000007660000-0x000000000766E000-memory.dmpFilesize
56KB
-
memory/3676-43-0x0000000007520000-0x00000000075C3000-memory.dmpFilesize
652KB
-
memory/3676-6-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3676-7-0x0000000005110000-0x0000000005738000-memory.dmpFilesize
6.2MB
-
memory/3676-29-0x00000000074C0000-0x00000000074F2000-memory.dmpFilesize
200KB
-
memory/3676-31-0x00000000708A0000-0x0000000070BF4000-memory.dmpFilesize
3.3MB
-
memory/3676-5-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/3676-42-0x0000000007500000-0x000000000751E000-memory.dmpFilesize
120KB
-
memory/3676-41-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3676-4-0x00000000025E0000-0x0000000002616000-memory.dmpFilesize
216KB
-
memory/4488-94-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/4488-95-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/4488-122-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/4488-109-0x0000000070EA0000-0x00000000711F4000-memory.dmpFilesize
3.3MB
-
memory/4488-110-0x000000007F640000-0x000000007F650000-memory.dmpFilesize
64KB
-
memory/4488-120-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/4488-108-0x0000000070720000-0x000000007076C000-memory.dmpFilesize
304KB
-
memory/4488-96-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB