Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-04-2024 08:03
Static task
static1
Behavioral task
behavioral1
Sample
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe
Resource
win10v2004-20240412-en
General
-
Target
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe
-
Size
4.1MB
-
MD5
15e38cc270fba2fc47e9ddcd5363bc72
-
SHA1
13308663b42dc93493fb51cbc785d5fc0c55294f
-
SHA256
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7
-
SHA512
a76e034c2a9c0c459654c9645e7b4dffb0039f5e19d4947f51dc9e4b288f7219dfa6107755c8ac3c0c837b6fda4281ae3969bc99e42aa96fd95420c55bc4c31c
-
SSDEEP
98304:r4qWg+YQzLmftPjRs7JtBhUiZv1ggcXutB8ev+3Whzrp:rWg+YEmQ7rBhUiZtgg2AB8elhzrp
Malware Config
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2972-2-0x0000000004010000-0x00000000048FB000-memory.dmp family_glupteba behavioral2/memory/2972-3-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/1392-53-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/2972-65-0x0000000004010000-0x00000000048FB000-memory.dmp family_glupteba behavioral2/memory/2972-80-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/1392-128-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/1392-146-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-231-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-248-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-263-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-278-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-293-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-308-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-323-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-338-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba behavioral2/memory/572-353-0x0000000000400000-0x0000000001DEE000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3064 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 572 csrss.exe -
Processes:
resource yara_rule behavioral2/memory/4868-246-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3488-261-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3488-291-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe -
Drops file in Windows directory 2 IoCs
Processes:
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exedescription ioc process File opened for modification C:\Windows\rss 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe File created C:\Windows\rss\csrss.exe 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3852 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1424 schtasks.exe 4048 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exepowershell.exe1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exepowershell.exe1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.exepid process 5080 powershell.exe 5080 powershell.exe 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 5052 powershell.exe 5052 powershell.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe 560 powershell.exe 560 powershell.exe 4240 powershell.exe 4240 powershell.exe 3532 powershell.exe 3532 powershell.exe 1508 powershell.exe 1508 powershell.exe 2416 powershell.exe 2416 powershell.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe 1624 injector.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exe1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesc.exedescription pid process Token: SeDebugPrivilege 5080 powershell.exe Token: SeDebugPrivilege 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Token: SeImpersonatePrivilege 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe Token: SeDebugPrivilege 5052 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 3532 powershell.exe Token: SeDebugPrivilege 1508 powershell.exe Token: SeDebugPrivilege 2416 powershell.exe Token: SeSecurityPrivilege 3852 sc.exe Token: SeSecurityPrivilege 3852 sc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.execmd.exewindefender.execmd.exedescription pid process target process PID 2972 wrote to memory of 5080 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 2972 wrote to memory of 5080 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 2972 wrote to memory of 5080 2972 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 5052 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 5052 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 5052 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 4520 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe cmd.exe PID 1392 wrote to memory of 4520 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe cmd.exe PID 4520 wrote to memory of 3064 4520 cmd.exe netsh.exe PID 4520 wrote to memory of 3064 4520 cmd.exe netsh.exe PID 1392 wrote to memory of 560 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 560 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 560 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 4240 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 4240 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 4240 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe powershell.exe PID 1392 wrote to memory of 572 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe csrss.exe PID 1392 wrote to memory of 572 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe csrss.exe PID 1392 wrote to memory of 572 1392 1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe csrss.exe PID 4868 wrote to memory of 2648 4868 windefender.exe cmd.exe PID 4868 wrote to memory of 2648 4868 windefender.exe cmd.exe PID 4868 wrote to memory of 2648 4868 windefender.exe cmd.exe PID 2648 wrote to memory of 3852 2648 cmd.exe sc.exe PID 2648 wrote to memory of 3852 2648 cmd.exe sc.exe PID 2648 wrote to memory of 3852 2648 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe"C:\Users\Admin\AppData\Local\Temp\1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe"C:\Users\Admin\AppData\Local\Temp\1db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hl05osuk.ujy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f62120de86d0d32402e6a701ad02ec3d
SHA12d43849dbac7cf60b54dd00bcf6327a55d55d608
SHA25613c386d95236f80a386f31fa6a043efdfd113e32fdd3a020d4f7ce0a7f8533bd
SHA512b4d31ce534d3a1ea037159bae4ad65c1f2a45281ee5c72aec8ca2e6ee0f2a62c40f589a842cac986fb70dceed4c73bffa723384feef3e070b7078d72893aab31
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57d512bffc4ef0eca3a3c522133b9a02c
SHA1ef96470808ec1169ad2038f53f727239aea2e78e
SHA256e2172b02b320c4bb5d66089925c574855b91d6d135f1c2074ffde7c35d8dd650
SHA5127c6b5d5e7dacd21e33994d16374d3f5871aed96e78ff0c818511478f5a744097d4fa50a23b44843f389450489a2592142245c17cb98c322656bfc2489940258d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5fe5e042433500684c89c542d73734ce3
SHA101beabce3aac91a86a515a19a695ff4191cb5ec0
SHA256f8e5ee0867becac88dd82cceaf8af51f5d76a0ef5ba683f6a42914205353bb6b
SHA5123240eb0b44e874dbb67ed9e3834143b4b237e3be930b58eb087a15d6bb0b1b7c491b6a3556e19cbf7b9b73ce2f162614b438c834a80e444221eb7241f95f35a6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53efeb14f1db017a64bf28bf36f774b1a
SHA19d6142bc2a75e58ac717da3d71954010e6ab9910
SHA256db49ad9a652c06b185463b03a4ebc2cd18ce955a4fc98ac00cb24a0c52593b0b
SHA512ae2ee5bbf796aae89c09b7930671262a9695043ae113ec1cd44a00ac427a672a704682e6e1972639e4728770c6e7f150f019a32b8e23a498cd2156b22ea24860
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c56f772a4cb6b6f5b4183ff25fc1c6d3
SHA1ce316da6c39ea1ac02f72d4c298cf60905fc6b5f
SHA256b48c01f1a9edf24528eb4516a90c4549879b840043f048cc997c6b0797aeeb1e
SHA51209d73293d1660dcce32a9c09c0330f8d2351466a466c882588b7bac6fb59f059aff57b1ba7c8c11f6388dcedc355eb5dbc70ab9a4420b5e293b7f14e1b90cb9a
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD515e38cc270fba2fc47e9ddcd5363bc72
SHA113308663b42dc93493fb51cbc785d5fc0c55294f
SHA2561db84bb49a0b7ad45f484cab8b4b46bb600e9f032eea05b7be412f3aaf8cffc7
SHA512a76e034c2a9c0c459654c9645e7b4dffb0039f5e19d4947f51dc9e4b288f7219dfa6107755c8ac3c0c837b6fda4281ae3969bc99e42aa96fd95420c55bc4c31c
-
memory/560-112-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/560-100-0x000000007F320000-0x000000007F330000-memory.dmpFilesize
64KB
-
memory/560-98-0x0000000005640000-0x0000000005997000-memory.dmpFilesize
3.3MB
-
memory/560-102-0x00000000704B0000-0x0000000070807000-memory.dmpFilesize
3.3MB
-
memory/560-113-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/560-88-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/560-115-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/560-89-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/560-101-0x0000000070310000-0x000000007035C000-memory.dmpFilesize
304KB
-
memory/572-235-0x0000000074900000-0x000000007491E000-memory.dmpFilesize
120KB
-
memory/572-278-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-236-0x00000000748E0000-0x00000000748F1000-memory.dmpFilesize
68KB
-
memory/572-231-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-248-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-250-0x0000000074920000-0x0000000074987000-memory.dmpFilesize
412KB
-
memory/572-255-0x0000000074890000-0x00000000748D1000-memory.dmpFilesize
260KB
-
memory/572-353-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-263-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-233-0x0000000074920000-0x0000000074987000-memory.dmpFilesize
412KB
-
memory/572-338-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-293-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-308-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/572-323-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/1392-128-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/1392-146-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/1392-52-0x0000000003B30000-0x0000000003F34000-memory.dmpFilesize
4.0MB
-
memory/1392-111-0x0000000003B30000-0x0000000003F34000-memory.dmpFilesize
4.0MB
-
memory/1392-53-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/2972-55-0x0000000003C10000-0x000000000400E000-memory.dmpFilesize
4.0MB
-
memory/2972-65-0x0000000004010000-0x00000000048FB000-memory.dmpFilesize
8.9MB
-
memory/2972-1-0x0000000003C10000-0x000000000400E000-memory.dmpFilesize
4.0MB
-
memory/2972-80-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/2972-3-0x0000000000400000-0x0000000001DEE000-memory.dmpFilesize
25.9MB
-
memory/2972-2-0x0000000004010000-0x00000000048FB000-memory.dmpFilesize
8.9MB
-
memory/3488-261-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3488-291-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4240-116-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/4240-125-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4240-126-0x0000000004F10000-0x0000000004F20000-memory.dmpFilesize
64KB
-
memory/4240-129-0x000000007F810000-0x000000007F820000-memory.dmpFilesize
64KB
-
memory/4868-246-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5052-79-0x00000000071D0000-0x0000000007274000-memory.dmpFilesize
656KB
-
memory/5052-86-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/5052-83-0x0000000007550000-0x0000000007565000-memory.dmpFilesize
84KB
-
memory/5052-82-0x0000000007500000-0x0000000007511000-memory.dmpFilesize
68KB
-
memory/5052-81-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/5052-68-0x000000007F550000-0x000000007F560000-memory.dmpFilesize
64KB
-
memory/5052-69-0x0000000070310000-0x000000007035C000-memory.dmpFilesize
304KB
-
memory/5052-70-0x0000000070520000-0x0000000070877000-memory.dmpFilesize
3.3MB
-
memory/5052-66-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/5052-67-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/5052-64-0x0000000005A70000-0x0000000005DC7000-memory.dmpFilesize
3.3MB
-
memory/5052-54-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/5080-50-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/5080-47-0x0000000007BE0000-0x0000000007BE8000-memory.dmpFilesize
32KB
-
memory/5080-46-0x0000000007C00000-0x0000000007C1A000-memory.dmpFilesize
104KB
-
memory/5080-45-0x0000000007B00000-0x0000000007B15000-memory.dmpFilesize
84KB
-
memory/5080-44-0x0000000007AF0000-0x0000000007AFE000-memory.dmpFilesize
56KB
-
memory/5080-43-0x0000000007AB0000-0x0000000007AC1000-memory.dmpFilesize
68KB
-
memory/5080-42-0x0000000007B40000-0x0000000007BD6000-memory.dmpFilesize
600KB
-
memory/5080-41-0x0000000007A80000-0x0000000007A8A000-memory.dmpFilesize
40KB
-
memory/5080-39-0x0000000008090000-0x000000000870A000-memory.dmpFilesize
6.5MB
-
memory/5080-40-0x0000000007A40000-0x0000000007A5A000-memory.dmpFilesize
104KB
-
memory/5080-25-0x00000000078C0000-0x00000000078F4000-memory.dmpFilesize
208KB
-
memory/5080-38-0x0000000003050000-0x0000000003060000-memory.dmpFilesize
64KB
-
memory/5080-37-0x0000000007920000-0x00000000079C4000-memory.dmpFilesize
656KB
-
memory/5080-27-0x0000000070490000-0x00000000707E7000-memory.dmpFilesize
3.3MB
-
memory/5080-36-0x0000000007900000-0x000000000791E000-memory.dmpFilesize
120KB
-
memory/5080-26-0x0000000070310000-0x000000007035C000-memory.dmpFilesize
304KB
-
memory/5080-24-0x000000007F400000-0x000000007F410000-memory.dmpFilesize
64KB
-
memory/5080-23-0x0000000006A60000-0x0000000006AA6000-memory.dmpFilesize
280KB
-
memory/5080-22-0x00000000064D0000-0x000000000651C000-memory.dmpFilesize
304KB
-
memory/5080-21-0x00000000064B0000-0x00000000064CE000-memory.dmpFilesize
120KB
-
memory/5080-20-0x0000000005FB0000-0x0000000006307000-memory.dmpFilesize
3.3MB
-
memory/5080-11-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/5080-10-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/5080-9-0x00000000055D0000-0x00000000055F2000-memory.dmpFilesize
136KB
-
memory/5080-8-0x0000000005890000-0x0000000005EBA000-memory.dmpFilesize
6.2MB
-
memory/5080-7-0x0000000003050000-0x0000000003060000-memory.dmpFilesize
64KB
-
memory/5080-6-0x0000000003050000-0x0000000003060000-memory.dmpFilesize
64KB
-
memory/5080-5-0x00000000740A0000-0x0000000074851000-memory.dmpFilesize
7.7MB
-
memory/5080-4-0x0000000002FB0000-0x0000000002FE6000-memory.dmpFilesize
216KB