Analysis
-
max time kernel
11s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-04-2024 20:43
Static task
static1
Behavioral task
behavioral1
Sample
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe
Resource
win10v2004-20240412-en
General
-
Target
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe
-
Size
4.1MB
-
MD5
574ad438c3716a1f065c97c5d09ce0d5
-
SHA1
c2664def6b19bfb54124d645987cf4ec2f73f501
-
SHA256
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c
-
SHA512
abf542772dd54fbb082d720aaa22b4d190dfb1ca7476f443c2087346faae4d29f4adc8d0d879a25ea43325db781e1964344d68c346a36ce0a5b4dd78ba1d4551
-
SSDEEP
98304:4wsyYpLI30hNm0X97sfQhuFOzbEeYixTYaktM3XAOoYGnm0lEv:+llzc0tsfv+41ixUfgAfRVY
Malware Config
Signatures
-
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/2692-2-0x0000000006650000-0x0000000006F3B000-memory.dmp family_glupteba behavioral2/memory/2692-63-0x0000000006650000-0x0000000006F3B000-memory.dmp family_glupteba behavioral2/memory/2692-145-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/1520-202-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-235-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-247-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-251-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-255-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-259-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-263-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-267-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-271-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-275-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-279-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-283-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-287-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba behavioral2/memory/2288-291-0x0000000000400000-0x0000000004417000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2896 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 2288 csrss.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4660-245-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3540-249-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3540-257-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe -
Drops file in Windows directory 2 IoCs
Processes:
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exedescription ioc process File opened for modification C:\Windows\rss 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe File created C:\Windows\rss\csrss.exe 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3004 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1916 schtasks.exe 3044 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exe3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exepowershell.exe3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exepowershell.exepowershell.exepowershell.exepid process 1784 powershell.exe 1784 powershell.exe 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1820 powershell.exe 1820 powershell.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe 4380 powershell.exe 4380 powershell.exe 132 powershell.exe 132 powershell.exe 4620 powershell.exe 4620 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exe3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Token: SeImpersonatePrivilege 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe Token: SeDebugPrivilege 1820 powershell.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 132 powershell.exe Token: SeDebugPrivilege 4620 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.execmd.execsrss.exedescription pid process target process PID 2692 wrote to memory of 1784 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 2692 wrote to memory of 1784 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 2692 wrote to memory of 1784 2692 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 1820 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 1820 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 1820 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 3912 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe cmd.exe PID 1520 wrote to memory of 3912 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe cmd.exe PID 3912 wrote to memory of 2896 3912 cmd.exe netsh.exe PID 3912 wrote to memory of 2896 3912 cmd.exe netsh.exe PID 1520 wrote to memory of 4380 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 4380 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 4380 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 132 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 132 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 132 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe powershell.exe PID 1520 wrote to memory of 2288 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe csrss.exe PID 1520 wrote to memory of 2288 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe csrss.exe PID 1520 wrote to memory of 2288 1520 3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe csrss.exe PID 2288 wrote to memory of 4620 2288 csrss.exe powershell.exe PID 2288 wrote to memory of 4620 2288 csrss.exe powershell.exe PID 2288 wrote to memory of 4620 2288 csrss.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe"C:\Users\Admin\AppData\Local\Temp\3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe"C:\Users\Admin\AppData\Local\Temp\3fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:132 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1916 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:5068
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1324
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:3872
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3044 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4660
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2844
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:3004
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:3540
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqoiglgj.1yq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57c870ab79d084a69e151244bedc455ce
SHA1569c6df13c46316108af50605c8c3084c323c092
SHA256aee6ed31d3fe7b0c340a56ff36d152f0b52a03eb0a6568e1494521dc7effefd1
SHA512d7e98d363f7ca69e419ac447fccbd4c0e6da3faafcae293ceeb21723130386c7cb77ca242e2cb62c644ffd5aef79cfbd08a73de00e073bdc754ab8e520e28ad2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5048f8fd41a7f3ef50c3828c5cc402942
SHA1108e4e2920757642f827ab90435da0c6a12c1648
SHA2563b88ff163f0d7f10dbb926dea674d4c270a347c5b91c3b0f47dbe57cec48e775
SHA5125e7e93c4a2a548521c3fbc3626c4632039eb908c18ec978c35fb0ee50c52002056e88b32b7a825c8765e338cfaddc2b88bda8e03f958857d6b86c56b2bb96f8c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5da32b59812543d537d30a167388b2b06
SHA12f92f57bcb0ec1923444a9754138da35aedacd34
SHA2560d386a3e25df6d03cda97ebbe2e64f805b64881b0420904e44ca5e0d9ec23e17
SHA512150e4315cc2555bbb65d5192da25700ea54a1a9cea3da2e2c92e32eb62b227295fbd7c908fcd86dd559d479bcd60de4c3f788ef0b9a233f34ebfc088de307a76
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD54cb1cc6c863c11e1183377012ef3b3d2
SHA10fe043109b7235c910d9499a32219c5df3785571
SHA25677836cf40c2cb8b8c37a9fba6bebe5a89efb6424087e9e89e2629067e6533dbf
SHA512d2cc6e3d297d3002f8cd36e9ee1d8a8412a1a0f4d52f28c6d41cb072d7cca86090d0c0624fed258dd0b581b5c4c7f08ea984cb425cd66a64fadf5440bb7b3ec6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53b029130e69d51a4510c8ba8eac44b68
SHA1ae34d89bd7b316979ac63971a558ef5e009c4da0
SHA25631a60ec0553821ab2d02fa74415f2d0be729f809f3e0926da8916c69148a3e9f
SHA5126c284b33ee0682518af83f85eda356042e4807d1ec6c5c507395481e4dd499c15ef772a21558edd72775bd525d296e8b4b8e81eb4859d090df5fc82167dff395
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5574ad438c3716a1f065c97c5d09ce0d5
SHA1c2664def6b19bfb54124d645987cf4ec2f73f501
SHA2563fedc819a31e5cb9f2e57e4231ed44a0253dc757ae2f1c2189ddd8a644a7609c
SHA512abf542772dd54fbb082d720aaa22b4d190dfb1ca7476f443c2087346faae4d29f4adc8d0d879a25ea43325db781e1964344d68c346a36ce0a5b4dd78ba1d4551
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/132-111-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/132-135-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/132-137-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/132-126-0x0000000070230000-0x0000000070587000-memory.dmpFilesize
3.3MB
-
memory/132-125-0x0000000070020000-0x000000007006C000-memory.dmpFilesize
304KB
-
memory/132-124-0x000000007FB30000-0x000000007FB40000-memory.dmpFilesize
64KB
-
memory/132-113-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/132-112-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/132-122-0x0000000005800000-0x0000000005B57000-memory.dmpFilesize
3.3MB
-
memory/1520-107-0x0000000006210000-0x0000000006610000-memory.dmpFilesize
4.0MB
-
memory/1520-50-0x0000000006210000-0x0000000006610000-memory.dmpFilesize
4.0MB
-
memory/1520-202-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/1784-23-0x0000000007160000-0x0000000007194000-memory.dmpFilesize
208KB
-
memory/1784-21-0x0000000006D10000-0x0000000006D56000-memory.dmpFilesize
280KB
-
memory/1784-40-0x0000000007440000-0x00000000074D6000-memory.dmpFilesize
600KB
-
memory/1784-41-0x0000000007350000-0x0000000007361000-memory.dmpFilesize
68KB
-
memory/1784-42-0x00000000073A0000-0x00000000073AE000-memory.dmpFilesize
56KB
-
memory/1784-43-0x00000000073B0000-0x00000000073C5000-memory.dmpFilesize
84KB
-
memory/1784-44-0x0000000007400000-0x000000000741A000-memory.dmpFilesize
104KB
-
memory/1784-45-0x0000000007420000-0x0000000007428000-memory.dmpFilesize
32KB
-
memory/1784-48-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/1784-37-0x0000000007930000-0x0000000007FAA000-memory.dmpFilesize
6.5MB
-
memory/1784-38-0x00000000072F0000-0x000000000730A000-memory.dmpFilesize
104KB
-
memory/1784-3-0x0000000004900000-0x0000000004936000-memory.dmpFilesize
216KB
-
memory/1784-4-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/1784-5-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1784-36-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1784-6-0x0000000004F70000-0x000000000559A000-memory.dmpFilesize
6.2MB
-
memory/1784-7-0x0000000004E70000-0x0000000004E92000-memory.dmpFilesize
136KB
-
memory/1784-8-0x00000000056A0000-0x0000000005706000-memory.dmpFilesize
408KB
-
memory/1784-9-0x0000000005710000-0x0000000005776000-memory.dmpFilesize
408KB
-
memory/1784-18-0x0000000005940000-0x0000000005C97000-memory.dmpFilesize
3.3MB
-
memory/1784-19-0x0000000005D20000-0x0000000005D3E000-memory.dmpFilesize
120KB
-
memory/1784-20-0x0000000005D70000-0x0000000005DBC000-memory.dmpFilesize
304KB
-
memory/1784-39-0x0000000007330000-0x000000000733A000-memory.dmpFilesize
40KB
-
memory/1784-35-0x00000000071C0000-0x0000000007264000-memory.dmpFilesize
656KB
-
memory/1784-24-0x0000000070020000-0x000000007006C000-memory.dmpFilesize
304KB
-
memory/1784-25-0x00000000701A0000-0x00000000704F7000-memory.dmpFilesize
3.3MB
-
memory/1784-34-0x00000000071A0000-0x00000000071BE000-memory.dmpFilesize
120KB
-
memory/1784-22-0x000000007F350000-0x000000007F360000-memory.dmpFilesize
64KB
-
memory/1820-81-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/1820-78-0x0000000007AB0000-0x0000000007AC5000-memory.dmpFilesize
84KB
-
memory/1820-77-0x0000000007A60000-0x0000000007A71000-memory.dmpFilesize
68KB
-
memory/1820-66-0x00000000701A0000-0x00000000704F7000-memory.dmpFilesize
3.3MB
-
memory/1820-75-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/1820-76-0x0000000007540000-0x00000000075E4000-memory.dmpFilesize
656KB
-
memory/1820-65-0x0000000070020000-0x000000007006C000-memory.dmpFilesize
304KB
-
memory/1820-64-0x000000007F820000-0x000000007F830000-memory.dmpFilesize
64KB
-
memory/1820-62-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/1820-52-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/1820-61-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/2288-143-0x0000000006800000-0x0000000006C00000-memory.dmpFilesize
4.0MB
-
memory/2288-235-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-291-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-287-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-283-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-279-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-275-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-271-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-267-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-263-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-259-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-255-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-251-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2288-247-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2692-145-0x0000000000400000-0x0000000004417000-memory.dmpFilesize
64.1MB
-
memory/2692-1-0x0000000006240000-0x0000000006642000-memory.dmpFilesize
4.0MB
-
memory/2692-51-0x0000000006240000-0x0000000006642000-memory.dmpFilesize
4.0MB
-
memory/2692-63-0x0000000006650000-0x0000000006F3B000-memory.dmpFilesize
8.9MB
-
memory/2692-2-0x0000000006650000-0x0000000006F3B000-memory.dmpFilesize
8.9MB
-
memory/3540-257-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/3540-249-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4380-85-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4380-84-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4380-83-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/4380-110-0x0000000073DB0000-0x0000000074561000-memory.dmpFilesize
7.7MB
-
memory/4380-86-0x0000000005D80000-0x00000000060D7000-memory.dmpFilesize
3.3MB
-
memory/4380-97-0x0000000070020000-0x000000007006C000-memory.dmpFilesize
304KB
-
memory/4380-96-0x000000007F5E0000-0x000000007F5F0000-memory.dmpFilesize
64KB
-
memory/4380-98-0x0000000070270000-0x00000000705C7000-memory.dmpFilesize
3.3MB
-
memory/4380-108-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4660-245-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB