Analysis
-
max time kernel
179s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 13:03
Static task
static1
General
-
Target
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe
-
Size
4.1MB
-
MD5
8610f22b9ae7b613159f9980da7e315f
-
SHA1
de33ed7d4fc789bfa2879603587c6c35ad8e0b7f
-
SHA256
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9
-
SHA512
21a47ec87f57e9cd04777144ccbcad14b06faa8aee62aaccc750c72bb1671b1776ade2e70e8f67fc26c94dd50f3055168420349ba90713971b31390bd1979111
-
SSDEEP
98304:Hlhp/+MAY8LSBetbsJnYPJay0ram2uVyHV/vsKO4IVa8TY/jpHwr1:HlT/+M2+BeVsJYPms9vsd3Va8M/jp0
Malware Config
Signatures
-
Glupteba payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4916-2-0x00000000052D0000-0x0000000005BBB000-memory.dmp family_glupteba behavioral1/memory/4916-3-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4916-5-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4916-6-0x00000000052D0000-0x0000000005BBB000-memory.dmp family_glupteba behavioral1/memory/4916-54-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4916-59-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4628-61-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4628-76-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4628-91-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4628-101-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4628-159-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-255-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-261-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-262-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-263-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-264-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-265-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-266-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-267-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-268-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba behavioral1/memory/4548-269-0x0000000000400000-0x0000000002FB8000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 4548 csrss.exe 3120 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe -
Drops file in Windows directory 2 IoCs
Processes:
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exedescription ioc process File opened for modification C:\Windows\rss e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe File created C:\Windows\rss\csrss.exe e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1220 schtasks.exe 668 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exee4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exepowershell.exee4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 116 powershell.exe 116 powershell.exe 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 3236 powershell.exe 3236 powershell.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe 2456 powershell.exe 2456 powershell.exe 2684 powershell.exe 2684 powershell.exe 4276 powershell.exe 4276 powershell.exe 2804 powershell.exe 2804 powershell.exe 3236 powershell.exe 3236 powershell.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 4548 csrss.exe 4548 csrss.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 4548 csrss.exe 4548 csrss.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe 3120 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exee4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 116 powershell.exe Token: SeDebugPrivilege 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Token: SeImpersonatePrivilege 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe Token: SeDebugPrivilege 3236 powershell.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeDebugPrivilege 4276 powershell.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 3236 powershell.exe Token: SeSystemEnvironmentPrivilege 4548 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exee4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.execmd.execsrss.exedescription pid process target process PID 4916 wrote to memory of 116 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4916 wrote to memory of 116 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4916 wrote to memory of 116 4916 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 3236 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 3236 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 3236 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 3708 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe cmd.exe PID 4628 wrote to memory of 3708 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe cmd.exe PID 3708 wrote to memory of 3892 3708 cmd.exe netsh.exe PID 3708 wrote to memory of 3892 3708 cmd.exe netsh.exe PID 4628 wrote to memory of 2456 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 2456 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 2456 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 2684 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 2684 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 2684 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe powershell.exe PID 4628 wrote to memory of 4548 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe csrss.exe PID 4628 wrote to memory of 4548 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe csrss.exe PID 4628 wrote to memory of 4548 4628 e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe csrss.exe PID 4548 wrote to memory of 4276 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 4276 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 4276 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 2804 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 2804 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 2804 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 3236 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 3236 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 3236 4548 csrss.exe powershell.exe PID 4548 wrote to memory of 3120 4548 csrss.exe injector.exe PID 4548 wrote to memory of 3120 4548 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe"C:\Users\Admin\AppData\Local\Temp\e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Users\Admin\AppData\Local\Temp\e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe"C:\Users\Admin\AppData\Local\Temp\e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3236
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2488
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3120 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:668
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhvwkisq.re3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD539eb24f27e551a6b70854067e38aded3
SHA15db9dc96fd599ed3813f6fcdad795b544fb8835f
SHA25602766065d5c2997b1e625fdce5ceee0c135a93070f1af9a73407718be177117d
SHA512985fea99cf5c373ac94df914f321a1743f85cb9c274c75f9b54e8af9ea583905bd25154d628909b4654cf29487a3187d0606d3d3dd2d80597bcfe0b180497ec8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52ea2f14355cc0ab5678cb358a5ea0150
SHA12d208f15c121252d73c96e50169e528f3a28aa8f
SHA25602e6ad5acda9bf6ae09e57ff68b488302ad8c96d572c5b66f45ce1397f975354
SHA512cd7361ac48e0425dfe0444a900307d6ff6c763cefd6a116239b4a1a44b70b4887a694bfa9e8e2c960d75dfd99f95b5385a023aa1e25b6d04e82b1949812c56e0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e9961d946a75853b1b336f97bd1368fe
SHA1c6887d627a74ef364137338c9b462a9dc158559c
SHA25603bbd53cf877721ba1de26210b42084d6d7103100171d2b97d4211c6e9dc8055
SHA512b714b269aa85761c70f878edb6f8419c5fd3dbc203ae21d1410d45d387f04e5bcaebb89843f84935b57317b7dbf2f12075fe46ba3b849c5525a58777fa99700b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f8b0ab242df5e8984d1ab56a52f3db8d
SHA13d33a476a53efbe5d1dfe5a690ac3f878ff83d94
SHA25676b5e8459cb8e78e75e356b22174cc47738c6de47073232e50f9e5eaed887493
SHA512482323528ef27e6d27574f038629d78e92613824ae028e0dcb6292a895226ba14b038ca534eda05b95f3eea68b7f711e31bf62310e81b4a27716ad4c1778a356
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56f1c11b76658255407e88c661fcad809
SHA1cf0c3c8eba6bb9c5f5683f7777e84930b68f6e22
SHA256eee2e8baab632e4d8cd6ea270b344bda7ae8198b8cdaa9c11dd5a6de0622a3f2
SHA5124abaa1cb53d3256c6411e5bbc6869eb38fe742430a41508defecb966f41b64c7ae3e46243fb41a3ca3510c85fc31c95f5ede5f5354ed2e84b323d511e91fc362
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD58610f22b9ae7b613159f9980da7e315f
SHA1de33ed7d4fc789bfa2879603587c6c35ad8e0b7f
SHA256e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9
SHA51221a47ec87f57e9cd04777144ccbcad14b06faa8aee62aaccc750c72bb1671b1776ade2e70e8f67fc26c94dd50f3055168420349ba90713971b31390bd1979111
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD58610f22b9ae7b613159f9980da7e315f
SHA1de33ed7d4fc789bfa2879603587c6c35ad8e0b7f
SHA256e4c693370e3439c8ef7f928c3118446c51bb99d2852354afd7faa238192ac3e9
SHA51221a47ec87f57e9cd04777144ccbcad14b06faa8aee62aaccc750c72bb1671b1776ade2e70e8f67fc26c94dd50f3055168420349ba90713971b31390bd1979111
-
memory/116-29-0x00000000080C0000-0x000000000873A000-memory.dmpFilesize
6.5MB
-
memory/116-35-0x00000000709A0000-0x0000000070CF4000-memory.dmpFilesize
3.3MB
-
memory/116-12-0x0000000005E30000-0x0000000005E96000-memory.dmpFilesize
408KB
-
memory/116-23-0x0000000006040000-0x0000000006394000-memory.dmpFilesize
3.3MB
-
memory/116-24-0x00000000066A0000-0x00000000066BE000-memory.dmpFilesize
120KB
-
memory/116-25-0x00000000066E0000-0x000000000672C000-memory.dmpFilesize
304KB
-
memory/116-26-0x0000000006B40000-0x0000000006B84000-memory.dmpFilesize
272KB
-
memory/116-27-0x0000000002FC0000-0x0000000002FD0000-memory.dmpFilesize
64KB
-
memory/116-28-0x0000000007980000-0x00000000079F6000-memory.dmpFilesize
472KB
-
memory/116-11-0x0000000005630000-0x0000000005652000-memory.dmpFilesize
136KB
-
memory/116-30-0x0000000007A60000-0x0000000007A7A000-memory.dmpFilesize
104KB
-
memory/116-31-0x0000000074980000-0x0000000075130000-memory.dmpFilesize
7.7MB
-
memory/116-33-0x0000000007C30000-0x0000000007C62000-memory.dmpFilesize
200KB
-
memory/116-32-0x000000007EEA0000-0x000000007EEB0000-memory.dmpFilesize
64KB
-
memory/116-34-0x0000000070820000-0x000000007086C000-memory.dmpFilesize
304KB
-
memory/116-13-0x0000000005EA0000-0x0000000005F06000-memory.dmpFilesize
408KB
-
memory/116-45-0x0000000007C10000-0x0000000007C2E000-memory.dmpFilesize
120KB
-
memory/116-46-0x0000000007C70000-0x0000000007D13000-memory.dmpFilesize
652KB
-
memory/116-47-0x0000000007D60000-0x0000000007D6A000-memory.dmpFilesize
40KB
-
memory/116-48-0x0000000007E20000-0x0000000007EB6000-memory.dmpFilesize
600KB
-
memory/116-49-0x0000000007D80000-0x0000000007D91000-memory.dmpFilesize
68KB
-
memory/116-50-0x0000000007DC0000-0x0000000007DCE000-memory.dmpFilesize
56KB
-
memory/116-51-0x0000000007DD0000-0x0000000007DE4000-memory.dmpFilesize
80KB
-
memory/116-52-0x0000000007EC0000-0x0000000007EDA000-memory.dmpFilesize
104KB
-
memory/116-53-0x0000000007E00000-0x0000000007E08000-memory.dmpFilesize
32KB
-
memory/116-57-0x0000000074980000-0x0000000075130000-memory.dmpFilesize
7.7MB
-
memory/116-10-0x0000000005690000-0x0000000005CB8000-memory.dmpFilesize
6.2MB
-
memory/116-9-0x0000000002FC0000-0x0000000002FD0000-memory.dmpFilesize
64KB
-
memory/116-8-0x0000000074980000-0x0000000075130000-memory.dmpFilesize
7.7MB
-
memory/116-7-0x0000000005020000-0x0000000005056000-memory.dmpFilesize
216KB
-
memory/2456-116-0x0000000070920000-0x000000007096C000-memory.dmpFilesize
304KB
-
memory/2456-100-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/2456-128-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/2456-117-0x0000000070AA0000-0x0000000070DF4000-memory.dmpFilesize
3.3MB
-
memory/2456-115-0x000000007FD50000-0x000000007FD60000-memory.dmpFilesize
64KB
-
memory/2456-113-0x0000000005920000-0x0000000005C74000-memory.dmpFilesize
3.3MB
-
memory/2456-103-0x0000000002920000-0x0000000002930000-memory.dmpFilesize
64KB
-
memory/2456-102-0x0000000002920000-0x0000000002930000-memory.dmpFilesize
64KB
-
memory/2684-131-0x0000000001620000-0x0000000001630000-memory.dmpFilesize
64KB
-
memory/2684-129-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/2684-130-0x0000000001620000-0x0000000001630000-memory.dmpFilesize
64KB
-
memory/3236-62-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/3236-64-0x00000000056B0000-0x0000000005A04000-memory.dmpFilesize
3.3MB
-
memory/3236-93-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3236-94-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3236-95-0x0000000007280000-0x0000000007294000-memory.dmpFilesize
80KB
-
memory/3236-98-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/3236-92-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/3236-63-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3236-74-0x0000000006040000-0x000000000608C000-memory.dmpFilesize
304KB
-
memory/3236-90-0x0000000007210000-0x0000000007221000-memory.dmpFilesize
68KB
-
memory/3236-89-0x0000000006F20000-0x0000000006FC3000-memory.dmpFilesize
652KB
-
memory/3236-79-0x00000000710C0000-0x0000000071414000-memory.dmpFilesize
3.3MB
-
memory/3236-77-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3236-78-0x0000000070920000-0x000000007096C000-memory.dmpFilesize
304KB
-
memory/4548-267-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-264-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-263-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-261-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-255-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-262-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-265-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-269-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-268-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4548-266-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-91-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-159-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-60-0x0000000004CC0000-0x00000000050BB000-memory.dmpFilesize
4.0MB
-
memory/4628-61-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-101-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-76-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4628-75-0x0000000004CC0000-0x00000000050BB000-memory.dmpFilesize
4.0MB
-
memory/4916-1-0x0000000004EC0000-0x00000000052C1000-memory.dmpFilesize
4.0MB
-
memory/4916-2-0x00000000052D0000-0x0000000005BBB000-memory.dmpFilesize
8.9MB
-
memory/4916-3-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4916-4-0x0000000004EC0000-0x00000000052C1000-memory.dmpFilesize
4.0MB
-
memory/4916-5-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4916-6-0x00000000052D0000-0x0000000005BBB000-memory.dmpFilesize
8.9MB
-
memory/4916-54-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB
-
memory/4916-59-0x0000000000400000-0x0000000002FB8000-memory.dmpFilesize
43.7MB