Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 12:41
Static task
static1
General
-
Target
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe
-
Size
4.2MB
-
MD5
0a951d37fb2c56a609059c96c4e1f058
-
SHA1
f7ecacabd84eb5651d8710bf4d8f2d21eca6d49c
-
SHA256
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498
-
SHA512
20f9805d5c7dd38a83fc8ae347da3237140278406d56180733d0bd3ef73d3eec822e89afe610bb84018f1a189781e69956a3a3bcdc2c6adf7ea64fdb90bea35a
-
SSDEEP
98304:14Oukmwozu5N1sjvc6C5HzAFpDV4v2Gff887WFFSEVpe1l6UqT5uNF:Mxw0u5Xsj06C5HzAFtV4vjftWfSDTd4U
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4712-134-0x0000000005160000-0x0000000005A4B000-memory.dmp family_glupteba behavioral1/memory/4124-136-0x00000000026D0000-0x00000000026E0000-memory.dmp family_glupteba behavioral1/memory/4712-157-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4712-192-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/2140-209-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/2140-267-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-320-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-354-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-357-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-360-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-363-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-366-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-369-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-372-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-375-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-378-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba behavioral1/memory/4996-381-0x0000000000400000-0x00000000030DE000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 4996 csrss.exe 4084 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe -
Drops file in Windows directory 2 IoCs
Processes:
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exedescription ioc process File opened for modification C:\Windows\rss d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe File created C:\Windows\rss\csrss.exe d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4192 schtasks.exe 2676 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exed20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exed20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exepowershell.exed20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4124 powershell.exe 4124 powershell.exe 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 4656 powershell.exe 4656 powershell.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe 408 powershell.exe 408 powershell.exe 1404 powershell.exe 1404 powershell.exe 316 powershell.exe 316 powershell.exe 3012 powershell.exe 3012 powershell.exe 1820 powershell.exe 1820 powershell.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4996 csrss.exe 4996 csrss.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4996 csrss.exe 4996 csrss.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe 4084 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exed20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Token: SeImpersonatePrivilege 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeDebugPrivilege 408 powershell.exe Token: SeDebugPrivilege 1404 powershell.exe Token: SeDebugPrivilege 316 powershell.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 1820 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exed20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.execmd.execsrss.exedescription pid process target process PID 4712 wrote to memory of 4124 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 4712 wrote to memory of 4124 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 4712 wrote to memory of 4124 4712 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 4656 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 4656 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 4656 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 3800 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe cmd.exe PID 2140 wrote to memory of 3800 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe cmd.exe PID 3800 wrote to memory of 812 3800 cmd.exe netsh.exe PID 3800 wrote to memory of 812 3800 cmd.exe netsh.exe PID 2140 wrote to memory of 408 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 408 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 408 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 1404 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 1404 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 1404 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe powershell.exe PID 2140 wrote to memory of 4996 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe csrss.exe PID 2140 wrote to memory of 4996 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe csrss.exe PID 2140 wrote to memory of 4996 2140 d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe csrss.exe PID 4996 wrote to memory of 316 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 316 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 316 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 3012 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 3012 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 3012 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 1820 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 1820 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 1820 4996 csrss.exe powershell.exe PID 4996 wrote to memory of 4084 4996 csrss.exe injector.exe PID 4996 wrote to memory of 4084 4996 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe"C:\Users\Admin\AppData\Local\Temp\d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe"C:\Users\Admin\AppData\Local\Temp\d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vi31pett.wvy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a7aa01fc92dffa6bc6c64db1a727541e
SHA18bab1470a220dd9c507115550da03fc2d50b8b38
SHA25654ceebbd575c8f659736a02fe70d4484ed80990063496eef7a0fce91df98cc2d
SHA512dadb9f078677f1a289f3d62d17d338298d7ff4d318cbbc52a09cdd4c2796c8bd4fe76e615d75f872951398b985f4174a53239b68cdabf7bc55038f3e5e7a3349
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f595bc1cdfd6015d7fd57037f3c5ff86
SHA14af4087b7aafaf2be0903660e3fdda5dbd9abcb3
SHA256f2d2b329131a90ffd3ae2d309d2590b37584685ecf0759375d80f907d895bc63
SHA512e83f10477ec04c4d99ccea33e2b7542374e8535a69c194aa94690a4cd9388a613dec0035ada604268a0715b82bc4a2874a89f3186dbb8a0973a12b58b15c5ec8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b23dbc7a388481e8683ec9a8bccbcb4e
SHA10d14ffadabd35fd78c1f1452ef43cab6ad0da106
SHA2566dd19958d314b59e9d4b476c72df88df01e45ea0eaf788152b12109a386a0f0f
SHA512e417475c08b9b783c3fe99edcce217646ab22a40b39043c075f90e9bb3ae7871b04c14852b19c09008b661be849bd031fe0f4333c46d8486773a30815867f9d2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5bdadf42fa612d6fd6a5f33d39a0dcab9
SHA11481b1205be06bd841d5e6b32763764affd0554d
SHA25613886ec087b04007590d6a639c7985be072a4d287a466d215d0c9da1f13d485f
SHA5125fc6d2078eb9744e2e75039acfedd04a4935ac3fe6ac2bb96d73825ffe7b9e62aafcad80a8f6535f9ecc6a20cd443a9e46d01f6d15d17d17deea3d13f826a114
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5088fb000d6597ab2668ecfcdc45689c7
SHA1251b9d4dc82405bbd5c8216fd2e51883dfb005e2
SHA256de51e01582cccfbd956dbe458dd20362d8cad900653083ef42d57d62c02df171
SHA512682e5c0f558fd67868b78391a4c135c0680b9cffe35c9404e731c9ded174b29a14ad1c604498c995212441e68305b0007b79386d220acd25647cd67d32690313
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD50a951d37fb2c56a609059c96c4e1f058
SHA1f7ecacabd84eb5651d8710bf4d8f2d21eca6d49c
SHA256d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498
SHA51220f9805d5c7dd38a83fc8ae347da3237140278406d56180733d0bd3ef73d3eec822e89afe610bb84018f1a189781e69956a3a3bcdc2c6adf7ea64fdb90bea35a
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD50a951d37fb2c56a609059c96c4e1f058
SHA1f7ecacabd84eb5651d8710bf4d8f2d21eca6d49c
SHA256d20831daf82bf9482b5cf19bded4d00e68594a5ad1475b61a4bc73c1e837d498
SHA51220f9805d5c7dd38a83fc8ae347da3237140278406d56180733d0bd3ef73d3eec822e89afe610bb84018f1a189781e69956a3a3bcdc2c6adf7ea64fdb90bea35a
-
memory/316-268-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/316-292-0x000000007FCE0000-0x000000007FCF0000-memory.dmpFilesize
64KB
-
memory/316-291-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/316-281-0x0000000070DA0000-0x00000000710F4000-memory.dmpFilesize
3.3MB
-
memory/316-280-0x0000000070C20000-0x0000000070C6C000-memory.dmpFilesize
304KB
-
memory/316-279-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/408-233-0x000000007FD70000-0x000000007FD80000-memory.dmpFilesize
64KB
-
memory/408-232-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/408-210-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/408-221-0x0000000070C20000-0x0000000070C6C000-memory.dmpFilesize
304KB
-
memory/408-222-0x0000000070DA0000-0x00000000710F4000-memory.dmpFilesize
3.3MB
-
memory/1404-259-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/1404-249-0x0000000070DA0000-0x00000000710F4000-memory.dmpFilesize
3.3MB
-
memory/1404-248-0x0000000070C20000-0x0000000070C6C000-memory.dmpFilesize
304KB
-
memory/1404-246-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/1404-247-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/1404-260-0x000000007F260000-0x000000007F270000-memory.dmpFilesize
64KB
-
memory/1820-335-0x0000000070CC0000-0x0000000071014000-memory.dmpFilesize
3.3MB
-
memory/1820-334-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/1820-323-0x0000000002BE0000-0x0000000002BF0000-memory.dmpFilesize
64KB
-
memory/1820-345-0x0000000002BE0000-0x0000000002BF0000-memory.dmpFilesize
64KB
-
memory/1820-346-0x000000007FB80000-0x000000007FB90000-memory.dmpFilesize
64KB
-
memory/2140-267-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/2140-209-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/3012-308-0x00000000045C0000-0x00000000045D0000-memory.dmpFilesize
64KB
-
memory/3012-304-0x00000000045C0000-0x00000000045D0000-memory.dmpFilesize
64KB
-
memory/3012-311-0x000000007FC60000-0x000000007FC70000-memory.dmpFilesize
64KB
-
memory/3012-309-0x0000000070CE0000-0x0000000071034000-memory.dmpFilesize
3.3MB
-
memory/3012-307-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/3012-305-0x00000000045C0000-0x00000000045D0000-memory.dmpFilesize
64KB
-
memory/4124-172-0x00000000075E0000-0x00000000075EA000-memory.dmpFilesize
40KB
-
memory/4124-176-0x0000000007680000-0x0000000007688000-memory.dmpFilesize
32KB
-
memory/4124-177-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/4124-135-0x00000000025F0000-0x0000000002626000-memory.dmpFilesize
216KB
-
memory/4124-175-0x0000000007690000-0x00000000076AA000-memory.dmpFilesize
104KB
-
memory/4124-174-0x0000000007630000-0x000000000763E000-memory.dmpFilesize
56KB
-
memory/4124-173-0x00000000076F0000-0x0000000007786000-memory.dmpFilesize
600KB
-
memory/4124-136-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/4124-171-0x0000000004CD0000-0x0000000004CEE000-memory.dmpFilesize
120KB
-
memory/4124-161-0x0000000070DC0000-0x0000000071114000-memory.dmpFilesize
3.3MB
-
memory/4124-152-0x00000000064D0000-0x0000000006514000-memory.dmpFilesize
272KB
-
memory/4124-159-0x0000000070C20000-0x0000000070C6C000-memory.dmpFilesize
304KB
-
memory/4124-137-0x0000000005080000-0x00000000056A8000-memory.dmpFilesize
6.2MB
-
memory/4124-138-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/4124-156-0x00000000072E0000-0x00000000072FA000-memory.dmpFilesize
104KB
-
memory/4124-155-0x0000000007930000-0x0000000007FAA000-memory.dmpFilesize
6.5MB
-
memory/4124-154-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/4124-153-0x00000000071C0000-0x0000000007236000-memory.dmpFilesize
472KB
-
memory/4124-139-0x0000000005050000-0x0000000005072000-memory.dmpFilesize
136KB
-
memory/4124-140-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/4124-160-0x000000007FCC0000-0x000000007FCD0000-memory.dmpFilesize
64KB
-
memory/4124-141-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/4124-158-0x00000000074B0000-0x00000000074E2000-memory.dmpFilesize
200KB
-
memory/4124-151-0x0000000005F20000-0x0000000005F3E000-memory.dmpFilesize
120KB
-
memory/4656-191-0x0000000004550000-0x0000000004560000-memory.dmpFilesize
64KB
-
memory/4656-193-0x0000000004550000-0x0000000004560000-memory.dmpFilesize
64KB
-
memory/4656-205-0x000000007FC20000-0x000000007FC30000-memory.dmpFilesize
64KB
-
memory/4656-194-0x0000000070C20000-0x0000000070C6C000-memory.dmpFilesize
304KB
-
memory/4656-190-0x0000000004550000-0x0000000004560000-memory.dmpFilesize
64KB
-
memory/4656-195-0x0000000070DA0000-0x00000000710F4000-memory.dmpFilesize
3.3MB
-
memory/4712-192-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4712-157-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4712-134-0x0000000005160000-0x0000000005A4B000-memory.dmpFilesize
8.9MB
-
memory/4996-375-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-381-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-354-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-360-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-363-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-366-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-369-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-372-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-320-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-378-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB
-
memory/4996-357-0x0000000000400000-0x00000000030DE000-memory.dmpFilesize
44.9MB