774a909d25058c8b4b68ffa67541aa8ab9f1187493dd62322500944ef0dfd1e2

Analysis

max time kernel
34s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Size 6.0MB
Sample240412-kbftkaha38
SHA256 774a909d25058c8b4b68ffa67541aa8ab9f1187493dd62322500944ef0dfd1e2
MD5 5bbd11ebebfc1e386178f53c87f4fe8d
SHA1 c2ccda47d0e634474296847b6f1c640af3d96d8b
SHA512 2cd432fe0fc9e27a015b3ee4ecae7780e4c3d54dcab64e919df5c630166d5bccb7ba013954f63b8020ab1576d7d2476c9ba8740c43403e85b8d511e086bfe5f9
SSDEEP 98304:7AFDc/A7ZAh3ByTl7Geu5nPIT2ZJHVNtgPpjwk+vmpoI3JCTDsRIDPYLT7Ryjl:RBh3w7Gh5Prtkb+fIU6IQRyx
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Detects executables packed with Themida 11 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320d-15.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-19-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-23-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-26-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-24-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-29-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-30-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-31-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-32-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-33-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4072-65-0x0000000073120000-0x0000000073C32000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000002320d-15.dat	themida
behavioral2/memory/4072-19-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-23-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-26-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-24-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-29-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-30-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-31-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-32-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-33-0x0000000073120000-0x0000000073C32000-memory.dmp	themida
behavioral2/memory/4072-65-0x0000000073120000-0x0000000073C32000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeUpdate.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	SBU.12.5.0.188.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_km.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_en.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\psuser_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\psuser_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_af.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_am.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_it.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	MicrosoftEdgeUpdate.exe

Executes dropped EXE 8 IoCs

pid	Process
2208	ITS SB App Switch.exe
4104	ITS SB App Switch.exe
3292	SBU.12.5.0.188.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
428	ITS SB App Switch.exe
2120	ITS SB App Switch.exe
3608	MicrosoftEdgeWebview2Setup.exe
2292	MicrosoftEdgeUpdate.exe

Loads dropped DLL 3 IoCs

pid	Process
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
2292	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3292	SBU.12.5.0.188.exe
3292	SBU.12.5.0.188.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
2292	MicrosoftEdgeUpdate.exe
2292	MicrosoftEdgeUpdate.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3292	SBU.12.5.0.188.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2292	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	2292	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	2292	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2292	MicrosoftEdgeUpdate.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4104	ITS SB App Switch.exe
4104	ITS SB App Switch.exe
4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
3292	SBU.12.5.0.188.exe
3292	SBU.12.5.0.188.exe
3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
2120	ITS SB App Switch.exe
2120	ITS SB App Switch.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 2208	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	84
PID 4072 wrote to memory of 2208	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	84
PID 4072 wrote to memory of 2208	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	84
PID 4072 wrote to memory of 4104	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	85
PID 4072 wrote to memory of 4104	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	85
PID 4072 wrote to memory of 4104	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	85
PID 4072 wrote to memory of 3292	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	92
PID 4072 wrote to memory of 3292	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	92
PID 4072 wrote to memory of 3292	4072	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	92
PID 3292 wrote to memory of 3552	3292	SBU.12.5.0.188.exe	96
PID 3292 wrote to memory of 3552	3292	SBU.12.5.0.188.exe	96
PID 3292 wrote to memory of 3552	3292	SBU.12.5.0.188.exe	96
PID 3552 wrote to memory of 428	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	97
PID 3552 wrote to memory of 428	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	97
PID 3552 wrote to memory of 428	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	97
PID 3552 wrote to memory of 2120	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	98
PID 3552 wrote to memory of 2120	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	98
PID 3552 wrote to memory of 2120	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	98
PID 3552 wrote to memory of 3608	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	99
PID 3552 wrote to memory of 3608	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	99
PID 3552 wrote to memory of 3608	3552	2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe	99
PID 3608 wrote to memory of 2292	3608	MicrosoftEdgeWebview2Setup.exe	101
PID 3608 wrote to memory of 2292	3608	MicrosoftEdgeWebview2Setup.exe	101
PID 3608 wrote to memory of 2292	3608	MicrosoftEdgeWebview2Setup.exe	101
PID 2292 wrote to memory of 5084	2292	MicrosoftEdgeUpdate.exe	102
PID 2292 wrote to memory of 5084	2292	MicrosoftEdgeUpdate.exe	102
PID 2292 wrote to memory of 5084	2292	MicrosoftEdgeUpdate.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\SBU.12.5.0.188.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\SBU.12.5.0.188.exe" /url"https://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=232&environment=production&institutionid=1063360&candidateid=0&language=enu&institutioncode=&enc=1&cmd=download&sc=7cfc815cc340aded1c653bdfe27249da3c76edf4" /exe"C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe" /updateversion"12.7.0.249" /minversion"12.7.0.249" /exitmessage"Error in Auto Updater"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe" /nocheck
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe"
      4⤵
      Executes dropped EXE
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe" 3552
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /AllUsers /S
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdate.exe" /AllUsers /S "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Checks whether UAC is enabled
        Checks computer location settings
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2292" "940" "784" "936" "0" "0" "0" "0" "0" "0" "0" "0"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 43f7de9fae6b79a844d7da6056ac82beadf028a347e227c2bc33d503f7eb402c
MD5 24e62a7c8d7f60336e60c003af843a87
SHA1 9576d1924d37113c301cadfd36481586cdef870c
SHA512 34f33015d3e7cabdea2ef39f7f149aaf39caa534b188a34021e577d68bbc48d1d99b7b13a1303d4ebaf5c29fda0bb573f3a6cb171aa2db67cc4b25292eac4a36
SSDEEP 3072:o/rfzYs6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+yWPduoKt5JbuEHxLDQmYZ2:JrZl/DFf3WC3as7B+mC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdate.dll
Size 2.1MB
SHA256 e9f1d362867beb3a767233de9d5af3a6e2762bb0627f291c6cb8f9faffb922ea
MD5 c1c4e3a4d49561dd0f6bc85f8062530d
SHA1 5394c3a4a2601a6bf7b06b5ae9119a3f0c95c974
SHA512 0e7f6d2a29c48d99fb417c630287d8d9e9f0365f1c1f2e415f0fc64e12e577c9d4e93bf6573a589e88c75a9dc6c5758fcfd970588c3d187621f8aff8e5ffc5b3
SSDEEP 49152:O+IqhBIe+leeM9O5uqpXHHMQk5/uF2rcq470HMa7oS4h:DIPe7P6Xnf2r9470Nov
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU90F5.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 cfbe36dac5d40f221f377aeaf2e983dc76ab3667f4672676a8fb37c7bd4f9fbd
MD5 f5f1ed2d55637a183674959e82cab3c2
SHA1 9472086a62950c6b40e1ecefc1fda4573e36ef3c
SHA512 9c4635f791608f815e359ce49f7535bcaca404dd4932efb23f638bc9900cd77854b1d38b5ca60e5dbf3e252cf06bb179b4d9a77368b524233117f48bef345013
SSDEEP 384:X1WVFXh7JWmsIWGkagyDl9FRt/NEHRN79xFDR9zd8V6d:FhagyDldbA9Tl9zkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_6E25F50391E2E781528C78498249E326

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_6E25F50391E2E781528C78498249E326
Size 471B
SHA256 6660ab2ddf00aeb09d8440f18e46fc19e5f0994ffe5d2c8a88dfc3c4c676fe1e
MD5 a3d9e252555e74f479e00cd489ba5fa5
SHA1 d8aca9c6da58f4f29839ee29eb721e5d3584d892
SHA512 81dbce351e3f75e1200a6ef323d5542319e0941e3615cd3fd1364e8aa5e2a0da2ebb5dc3eb2b34646aaa31b03ffb109a681061147be7f9007ac4c0d3abda8d6c
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 1KB
SHA256 1ff41d96dc66aa03a2f5c23c8433330b3c529a98d645871c8cd7dee4363baee2
MD5 c8ef81233e801a4c078c077f96ce8997
SHA1 9069b2fa8280e2ba89c65ca9c370720bb6b511c4
SHA512 7ab3b3e8e56b3f54abe0d8194d2cd3fe7672c29b16a4d4112d7b586bba16412121593e940fca5c745ae493986e85fddd9773547bc15e1eb670257c5e290cdf8a
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 181b4a6973e919809d979b609d7127dc2cb6b4890eecc20a0618ca40ce376c0e
MD5 eaec2c7db9c8691207f7b4b146855f3e
SHA1 939151df8d377a6b0cee150af5f6471397ea8098
SHA512 0d50a47be27346e30c087227f341f21f60d9bcadeb0342c746dd5071b4338c05c342db668f00e55ad10d5ed9cab74625becf5a57a5ca22c41affdb007f608a59
MD5 SHA1 SHA512

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_6E25F50391E2E781528C78498249E326

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_6E25F50391E2E781528C78498249E326
Size 404B
SHA256 3925fe6242628b58b926a972b7fee99ba3bce66563ab9d65988d806437cfb22d
MD5 7716fe71f5ae21148a67326b7abc2a22
SHA1 5b85043e4317fad245b5a881c86e4de875e039af
SHA512 83aa8756f2f31c4532a317025b00071c2f309e847e412aefe1e3e48a0c7b240f26700aac3e91a1bc350a4a033b46d0a9c5a654bcc7a4c00f9556fedd371be42d
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 482B
SHA256 1c314b03f1e5b21a5dbfaad205777e8667852c23964807095baae0899bfabfdb
MD5 918a7bb592a742175a50798ce5a44641
SHA1 d342f3d578badeb4544913b25e244340a9b73f39
SHA512 60b3d88811d5334c0cdfc25bcbdfa36a260a6fc0a88918a836f0f52f23627fa0bb82707af700b717bac57b077fed119bad5cc6e70df62f2afaed3f4b2dfe59f0
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 3363ec8982cd9f0108c3984533e63cdd4ee8436b8b20cc073f3ccfeee4f85234
MD5 7cc945b3af6c7ce68474d00924ce40c4
SHA1 3c5b02742d90649014952d778ae665b529a70028
SHA512 935048cd41ed56475e07a555cf4adb6c96b270d9ef52f3384c8c4e52425a4874656c94648ddb0da672cbf6159a6a2dd3f3241e05baa5cb0e285762864949f753
MD5 SHA1 SHA512

Submit Download

2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber.exe
Size 4.8MB
SHA256 5e7770af5bacbe3dcb8ec161179556687bb6be6e34aaa967924a70de54c2993b
MD5 c910014054936eb6563b83fb6348e1f8
SHA1 2eca43155cf8b1521792cc7bd5c640f377b231c0
SHA512 220b319ce7ecd173379523fe5b7c99b8c8bf6e1e924a36a1bc43c056a19727826ffaeacae8dbe83257f521149c4efd3200bffcb574590eaf35a7481db5b79fff
SSDEEP 98304:EtiuhquhmF1OgPptZDElaxQ3PCTDsRnLPYSz76yb:CtktIa6n36yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ITS SB App Switch.exe

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
Size 370KB
SHA256 db70869cfafb8877fd02beb9d970427e6103c1003d04eca2dad1ac9a9587d489
MD5 6e3b18cac5d61c109906e94ce895d2bc
SHA1 557d63dd72dc47e9b2d701c40e80fba1e108e9c5
SHA512 e27d2cf4e63b414b7a8e89c48e9b4c0ccb93e52c2405e9b5bbac13352daa3cf9e619b48845547ebdbfaa7ef8af850f1c3fe4b8ac228dfa3d14095d86cf82340b
SSDEEP 6144:eAtbp1XdlvtuTz1JrEiPqxPFTXPYZpPxcMgi5AJuNaZ3dPFh/jfk:Fp1XLvtuTz1JrEiiFTXPYXUJuNaPz7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ITS SB App Switch.exe

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ITS SB App Switch.exe
Size 370KB
SHA256 f68f56298c568438b13a1d7a2a955988fef0441d18788d4cae970fc58f5af667
MD5 1c78a9b8e3507342a01d1241e0eab818
SHA1 861a4e0770bfeb7e0fda3de55582e0efac9fc1d2
SHA512 ae1cd16f5e0cd99498c65d9e8ffb26115f7870c57d4a78ce95dc91302a4dd0a724598fe6bcc7449a20c7d5aa1c50ba0d856b7cc9bd371602ef743c477a77c346
SSDEEP 6144:hqlMn5s1y94XNw7atagEiDcAZvruIPY2joEW7nYW5cqJuN6eQHlh/j6r:Y+s1yeXNw7atagEi9v6IPY8iJuN6XT70
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProcessCheck.dll

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\ProcessCheck.dll
Size 624KB
SHA256 1638a6a6714f38d427cc733d26feb81bdf79524c8f8280348e9dd2770c90b037
MD5 dca4ad4393101c4c78deda710076bfae
SHA1 ff15bea9bd18d10fc6d8e3e6f4715f781068f91d
SHA512 6002a92dedaa26dd116bf9e68cec52f3a24a85b1e6aa76c86e3e4fd1ba99d58b5dbf2a9b592378fb49a4ee17b6b7ec2e627d0caaae39b65996b880e3c5220a61
SSDEEP 12288:aOELub1p00QmaZmDwPC4CfXqsswSAviBZs1iHQs:zELC1p59aZmDwPChswSPLHv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SBU.12.5.0.188.exe

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\SBU.12.5.0.188.exe
Size 367KB
SHA256 090f717a38d1ca5a944e1c9f0971d9f092dc4508badd1a9a245cbc75a47db8ea
MD5 63bf8e694c2037698b84a270dea1615f
SHA1 2cd3d489d91182872836f8a2b6ccbde98c234108
SHA512 82974870231030ff4b644a78270bde4cbf0d0170f6546143ee7560ff33dda6fee580c8f3773f18baf1265ad97e028a4bc1c0191c0677a9e3870838afb80157a6
SSDEEP 6144:cvs0lVjFWmXxOuH2bvPzpPzPM3t4WImynkmFVgyHD7C2bEP39pPzsSshpnrz:ctMpPzPM3t4d5VgyjEP39vshpnH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TestSecurity.12.5.0.188.dll

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\TestSecurity.12.5.0.188.dll
Size 2.8MB
SHA256 12a136eb15fe43b929926e9ad87d5d952bdbd002c6b35de07ec2e1a53e97cec5
MD5 669ea6b4f22dfc80cdff2c100ca3a055
SHA1 478d4f6109340da9e62a7c757238b5d2d6321c46
SHA512 4b1718a827d732502997ab5f4745da82f937765a6fcb8d1b182401d12842a1c5c5912e89bf820d46cbc158d1c07b7276ba05105132b507338f7667d0a433080e
SSDEEP 49152:/ZAh30JJt0p8xTl7M6NWeu2/iRnpdjLmJwen8wgoL7EVvRPBFGvCHVh/qL:/ZAh3ByTl7Geu5nPIT2ZJHVN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TestSecurity.12.7.0.249.dll

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\TestSecurity.12.7.0.249.dll
Size 1.6MB
SHA256 6b766ffee9ee5ebeee3830a90870afca99a79e7611fd81f2e4afab009513a3dc
MD5 a7d19e10c06f0b71f69c15e0c070f66a
SHA1 11a10b61e3925125b963e3074dea63f36084da23
SHA512 09cc5eff3529881d540ac96cf5fe488dc843d131d7c4527b2dbc4349c048a1cd2d1f190365f174d5972624805d07b84d513aa274144bd2974ced2ec57e2ed758
SSDEEP 12288:lgZSvwr/wWGqz1JuhmrP8f0FPMowlqa4y:ljIJuhmj8cPMlq1
MD5 SHA1 SHA512 SSDEEP

Submit Download

spinner.gif

Path C:\Users\Admin\AppData\Local\Temp\2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber\spinner.gif
Size 14KB
SHA256 dafcf9bbf9dcbd6ef0c3281a9cf739e115ef8934e6d711ca130a4d4eed19fb6e
MD5 a98a798d1bb6ad80560e4811d07ffbb5
SHA1 4e985d0366fa06beb628f1620edf32d592312e90
SHA512 a0a00c29f5fedf21bad7e49f3016353ce19e9a6501bc31d9cdc22e517504b2bbf43f86def6a5815276cbd4c213414a86bb0ea96ecbc1c6249d67b6de90e5798f
SSDEEP 192:6xCwKwZFVIa+NoyTXdDLac1dTr6FkiZ/WIXk/3Y/WGAZJgMoU86Ggf/Eo/n+:HwTZv5+NoyTNDWy5crY/3Y/WnZ4uEw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Size 1.6MB
SHA256 a63d59b2af0c7b2be6984280386042a230dab928e3b426d51a0afb2eff5f98e9
MD5 8b9812ba27e12c79319d859e97955ca4
SHA1 3cb35ac811c27e7b21b381dccab55517609190c3
SHA512 8312081fcca20f1d8d393ea2588c2fd19830eb9b36700ec8bc541cd25c4c2046008f3eec07883056956adae5c56083d43ded74d3122d21555d1e43a9d1ab5618
SSDEEP 24576:o9ye32wIdWoAH+miAQoCZoWf4fh29ht/5iqSxulBbxAl/f1scgIDnzMwdF9fZ4T+:Qye32wIuAAQZKwEqbBe1scgID7fZcZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4072-24-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-65-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-33-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-32-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-31-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-30-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-29-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-26-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-23-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4072-21-0x00000000775D4000-0x00000000775D6000-memory.dmp

Download

memory/4072-19-0x0000000073120000-0x0000000073C32000-memory.dmp

Download

memory/4104-14-0x00000000756B8000-0x00000000756B9000-memory.dmp

Download