Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 05:52
Static task
static1
General
-
Target
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe
-
Size
4.1MB
-
MD5
22cee26ca4443b37c17f55477a6fa8c9
-
SHA1
c9693cc022c953c02c3c6289886e6a35f65905a0
-
SHA256
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8
-
SHA512
a1dd2dd31f0e9d3678f53eeb35cf05e471abe63facf6618ba70e9993df978e706376dfe9927fd414c8f3b21b645a225fe49eee0b6ac51fd2113c83682ab89663
-
SSDEEP
98304:tQ5RaRg3XrWNRbKONOhs9MJlnsBwQGIGFXZ:tQ58OHrWWONOhfQGIs
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
Processes:
svchost.exedescription pid process target process PID 1080 created 4652 1080 svchost.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 1080 created 3516 1080 svchost.exe csrss.exe PID 1080 created 3516 1080 svchost.exe csrss.exe PID 1080 created 3516 1080 svchost.exe csrss.exe PID 1080 created 4700 1080 svchost.exe f801950a962ddba14caaa44bf084b55c.exe PID 1080 created 4700 1080 svchost.exe f801950a962ddba14caaa44bf084b55c.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.execsrss.exeinjector.exef801950a962ddba14caaa44bf084b55c.exepid process 5048 csrss.exe 3516 csrss.exe 408 injector.exe 4700 f801950a962ddba14caaa44bf084b55c.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx behavioral1/memory/4700-170-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exee4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.execsrss.exedescription pid process target process PID 4916 set thread context of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 set thread context of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 5048 set thread context of 3516 5048 csrss.exe csrss.exe -
Drops file in Windows directory 2 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exedescription ioc process File opened for modification C:\Windows\rss e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe File created C:\Windows\rss\csrss.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1420 schtasks.exe 1976 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exee4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exeinjector.execsrss.exepid process 4652 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 4652 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 3516 csrss.exe 3516 csrss.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 3516 csrss.exe 3516 csrss.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe 408 injector.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 4652 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Token: SeImpersonatePrivilege 4652 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe Token: SeTcbPrivilege 1080 svchost.exe Token: SeTcbPrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeSystemEnvironmentPrivilege 3516 csrss.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe Token: SeBackupPrivilege 1080 svchost.exe Token: SeRestorePrivilege 1080 svchost.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exesvchost.exee4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exee4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.execmd.execsrss.execsrss.exedescription pid process target process PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 4916 wrote to memory of 4652 4916 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 1080 wrote to memory of 3128 1080 svchost.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 1080 wrote to memory of 3128 1080 svchost.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 1080 wrote to memory of 3128 1080 svchost.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 3128 wrote to memory of 1788 3128 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe PID 1788 wrote to memory of 1528 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe cmd.exe PID 1788 wrote to memory of 1528 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe cmd.exe PID 1528 wrote to memory of 4612 1528 cmd.exe netsh.exe PID 1528 wrote to memory of 4612 1528 cmd.exe netsh.exe PID 1788 wrote to memory of 5048 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe csrss.exe PID 1788 wrote to memory of 5048 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe csrss.exe PID 1788 wrote to memory of 5048 1788 e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 5048 wrote to memory of 3516 5048 csrss.exe csrss.exe PID 1080 wrote to memory of 1420 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 1420 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 2516 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 2516 1080 svchost.exe schtasks.exe PID 3516 wrote to memory of 408 3516 csrss.exe injector.exe PID 3516 wrote to memory of 408 3516 csrss.exe injector.exe PID 1080 wrote to memory of 1976 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 1976 1080 svchost.exe schtasks.exe PID 3516 wrote to memory of 4700 3516 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 3516 wrote to memory of 4700 3516 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 3516 wrote to memory of 4700 3516 csrss.exe f801950a962ddba14caaa44bf084b55c.exe PID 1080 wrote to memory of 3420 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 3420 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 2648 1080 svchost.exe schtasks.exe PID 1080 wrote to memory of 2648 1080 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"C:\Users\Admin\AppData\Local\Temp\e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8.exe"4⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe7⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f8⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD522cee26ca4443b37c17f55477a6fa8c9
SHA1c9693cc022c953c02c3c6289886e6a35f65905a0
SHA256e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8
SHA512a1dd2dd31f0e9d3678f53eeb35cf05e471abe63facf6618ba70e9993df978e706376dfe9927fd414c8f3b21b645a225fe49eee0b6ac51fd2113c83682ab89663
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD522cee26ca4443b37c17f55477a6fa8c9
SHA1c9693cc022c953c02c3c6289886e6a35f65905a0
SHA256e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8
SHA512a1dd2dd31f0e9d3678f53eeb35cf05e471abe63facf6618ba70e9993df978e706376dfe9927fd414c8f3b21b645a225fe49eee0b6ac51fd2113c83682ab89663
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD522cee26ca4443b37c17f55477a6fa8c9
SHA1c9693cc022c953c02c3c6289886e6a35f65905a0
SHA256e4d676209751a983d57b71c107a04b87e85777011b01760fa886dd21a7fd45c8
SHA512a1dd2dd31f0e9d3678f53eeb35cf05e471abe63facf6618ba70e9993df978e706376dfe9927fd414c8f3b21b645a225fe49eee0b6ac51fd2113c83682ab89663
-
memory/408-162-0x0000000000000000-mapping.dmp
-
memory/1420-159-0x0000000000000000-mapping.dmp
-
memory/1528-147-0x0000000000000000-mapping.dmp
-
memory/1788-141-0x0000000000000000-mapping.dmp
-
memory/1788-146-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/1788-152-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/1976-165-0x0000000000000000-mapping.dmp
-
memory/2516-161-0x0000000000000000-mapping.dmp
-
memory/2648-173-0x0000000000000000-mapping.dmp
-
memory/3128-139-0x0000000000000000-mapping.dmp
-
memory/3128-144-0x00000000024D9000-0x00000000028C2000-memory.dmpFilesize
3.9MB
-
memory/3420-172-0x0000000000000000-mapping.dmp
-
memory/3516-153-0x0000000000000000-mapping.dmp
-
memory/3516-160-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/3516-166-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/3516-171-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/4612-148-0x0000000000000000-mapping.dmp
-
memory/4652-138-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/4652-136-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/4652-140-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/4652-133-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/4652-132-0x0000000000000000-mapping.dmp
-
memory/4700-167-0x0000000000000000-mapping.dmp
-
memory/4700-170-0x0000000000400000-0x0000000000C25000-memory.dmpFilesize
8.1MB
-
memory/4916-137-0x0000000002A50000-0x00000000032C7000-memory.dmpFilesize
8.5MB
-
memory/4916-135-0x0000000002658000-0x0000000002A41000-memory.dmpFilesize
3.9MB
-
memory/5048-157-0x0000000002A00000-0x0000000002DE9000-memory.dmpFilesize
3.9MB
-
memory/5048-149-0x0000000000000000-mapping.dmp