glupteba | b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48

Analysis

max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uni400uni.exe
Size

3.3MB
MD5

09bd16d82a747ef0621aa367c0e14a9c
SHA1

da57e4b192b7cb50b6e71b48d5f233d2a6b5a4f1
SHA256

b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48
SHA512

7365b17d9ec7264941b88d61e69ea1214ef44b9b8bff9ebc8227794b696142050f267635cdb4e588ba121259b2f2a07519df8053f143db58ebc1a048d08b49a1
SSDEEP

49152:9UIbNigeVE2MD7ZDAgUftcgFEptOkf8Ug:jI3bg5W

Score

10^/10

glupteba stealc discovery dropper evasion loader persistence rootkit spyware stealer themida trojan upx

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3456-61-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/3456-63-0x0000000003F10000-0x00000000047FB000-memory.dmp	family_glupteba
behavioral1/memory/1224-64-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/3456-154-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/3456-172-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1224-173-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1828-175-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1364-186-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1828-362-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1364-363-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/1828-366-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/5684-499-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/5684-514-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba
behavioral1/memory/5684-521-0x0000000000400000-0x0000000001DF9000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

FMAe74ffrvL7ajt27hKSKYDR.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	FMAe74ffrvL7ajt27hKSKYDR.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

FMAe74ffrvL7ajt27hKSKYDR.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FMAe74ffrvL7ajt27hKSKYDR.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1508 netsh.exe
2504 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FMAe74ffrvL7ajt27hKSKYDR.exe

pid	process
1508	netsh.exe
2504	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FMAe74ffrvL7ajt27hKSKYDR.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FMAe74ffrvL7ajt27hKSKYDR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FMAe74ffrvL7ajt27hKSKYDR.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regasm.exef8d6vyf8CcSsVmBPvqBWroL6.exeFMAe74ffrvL7ajt27hKSKYDR.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	regasm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	f8d6vyf8CcSsVmBPvqBWroL6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	FMAe74ffrvL7ajt27hKSKYDR.exe

Drops startup file 5 IoCs

Processes:

regasm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rdIbFJOT6tdmJ1205bmCt93V.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWQC7hn0wh7f9WtmwjIhp3kd.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yFYjidJEvSaIjZwx3MGVsros.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pyr1YirrVMyWDxIWVCe3ycwp.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gzDLd5dXWo6asI1eIpdoNZaD.bat	regasm.exe

Executes dropped EXE 11 IoCs

Processes:

f8d6vyf8CcSsVmBPvqBWroL6.exev658B7mgvx5DYbvRJJudn1dI.exeUD7KToN3dwJ6jD7So0SFAmru.exeu31w.0.exev658B7mgvx5DYbvRJJudn1dI.exeUD7KToN3dwJ6jD7So0SFAmru.execsrss.exeFMAe74ffrvL7ajt27hKSKYDR.exeinjector.exewindefender.exewindefender.exe

pid	process
3956	f8d6vyf8CcSsVmBPvqBWroL6.exe
3456	v658B7mgvx5DYbvRJJudn1dI.exe
1224	UD7KToN3dwJ6jD7So0SFAmru.exe
4480	u31w.0.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
5684	csrss.exe
4776	FMAe74ffrvL7ajt27hKSKYDR.exe
1560	injector.exe
2412	windefender.exe
1960	windefender.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\FMAe74ffrvL7ajt27hKSKYDR.exe	themida
behavioral1/memory/4776-432-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida
behavioral1/memory/4776-438-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida
behavioral1/memory/4776-439-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida
behavioral1/memory/4776-440-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida
behavioral1/memory/4776-442-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida
behavioral1/memory/4776-500-0x00007FF630600000-0x00007FF631109000-memory.dmp	themida

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/2412-509-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

UD7KToN3dwJ6jD7So0SFAmru.exev658B7mgvx5DYbvRJJudn1dI.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	UD7KToN3dwJ6jD7So0SFAmru.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

FMAe74ffrvL7ajt27hKSKYDR.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FMAe74ffrvL7ajt27hKSKYDR.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

8 pastebin.com
9 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

109 ipinfo.io
101 api.myip.com
102 api.myip.com
106 ipinfo.io
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

flow	ioc
8	pastebin.com
9	pastebin.com

flow	ioc
109	ipinfo.io
101	api.myip.com
102	api.myip.com
106	ipinfo.io

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 14 IoCs

Processes:

powershell.exepowershell.exeFMAe74ffrvL7ajt27hKSKYDR.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	FMAe74ffrvL7ajt27hKSKYDR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	FMAe74ffrvL7ajt27hKSKYDR.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	FMAe74ffrvL7ajt27hKSKYDR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	FMAe74ffrvL7ajt27hKSKYDR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

FMAe74ffrvL7ajt27hKSKYDR.exe

pid process

4776 FMAe74ffrvL7ajt27hKSKYDR.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Uni400uni.exe

description pid process target process

PID 4644 set thread context of 4588 4644 Uni400uni.exe regasm.exe

pid	process
4776	FMAe74ffrvL7ajt27hKSKYDR.exe

description	pid	process	target process
PID 4644 set thread context of 4588	4644	Uni400uni.exe	regasm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

Processes:

v658B7mgvx5DYbvRJJudn1dI.exeUD7KToN3dwJ6jD7So0SFAmru.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	v658B7mgvx5DYbvRJJudn1dI.exe
File opened (read-only)	\??\VBoxMiniRdrDN	UD7KToN3dwJ6jD7So0SFAmru.exe

Drops file in Windows directory 6 IoCs

Processes:

v658B7mgvx5DYbvRJJudn1dI.execsrss.exeUD7KToN3dwJ6jD7So0SFAmru.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	v658B7mgvx5DYbvRJJudn1dI.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	UD7KToN3dwJ6jD7So0SFAmru.exe
File created	C:\Windows\rss\csrss.exe	UD7KToN3dwJ6jD7So0SFAmru.exe
File opened for modification	C:\Windows\rss	v658B7mgvx5DYbvRJJudn1dI.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

816 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4316 4480 WerFault.exe u31w.0.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

6088 schtasks.exe
5992 schtasks.exe

pid	process
816	sc.exe

pid	pid_target	process	target process
4316	4480	WerFault.exe	u31w.0.exe

pid	process
6088	schtasks.exe
5992	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

v658B7mgvx5DYbvRJJudn1dI.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	v658B7mgvx5DYbvRJJudn1dI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeUD7KToN3dwJ6jD7So0SFAmru.exev658B7mgvx5DYbvRJJudn1dI.exepowershell.exepowershell.exev658B7mgvx5DYbvRJJudn1dI.exeUD7KToN3dwJ6jD7So0SFAmru.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
4776	powershell.exe
4776	powershell.exe
528	powershell.exe
528	powershell.exe
4776	powershell.exe
528	powershell.exe
1224	UD7KToN3dwJ6jD7So0SFAmru.exe
1224	UD7KToN3dwJ6jD7So0SFAmru.exe
3456	v658B7mgvx5DYbvRJJudn1dI.exe
3456	v658B7mgvx5DYbvRJJudn1dI.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1828	v658B7mgvx5DYbvRJJudn1dI.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
1364	UD7KToN3dwJ6jD7So0SFAmru.exe
3760	powershell.exe
3760	powershell.exe
4640	powershell.exe
4640	powershell.exe
3760	powershell.exe
4640	powershell.exe
5232	powershell.exe
5232	powershell.exe
5224	powershell.exe
5224	powershell.exe
5232	powershell.exe
5224	powershell.exe
5804	powershell.exe
5804	powershell.exe
5804	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
5460	powershell.exe
5460	powershell.exe
5460	powershell.exe
1560	injector.exe
1560	injector.exe
1560	injector.exe
1560	injector.exe
1560	injector.exe
1560	injector.exe
5684	csrss.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

regasm.exepowershell.exepowershell.exeUD7KToN3dwJ6jD7So0SFAmru.exev658B7mgvx5DYbvRJJudn1dI.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	4588	regasm.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	1224	UD7KToN3dwJ6jD7So0SFAmru.exe
Token: SeImpersonatePrivilege	1224	UD7KToN3dwJ6jD7So0SFAmru.exe
Token: SeDebugPrivilege	3456	v658B7mgvx5DYbvRJJudn1dI.exe
Token: SeImpersonatePrivilege	3456	v658B7mgvx5DYbvRJJudn1dI.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	5460	powershell.exe
Token: SeSystemEnvironmentPrivilege	5684	csrss.exe
Token: SeSecurityPrivilege	816	sc.exe
Token: SeSecurityPrivilege	816	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni400uni.exeregasm.exef8d6vyf8CcSsVmBPvqBWroL6.exeUD7KToN3dwJ6jD7So0SFAmru.exev658B7mgvx5DYbvRJJudn1dI.exev658B7mgvx5DYbvRJJudn1dI.exeUD7KToN3dwJ6jD7So0SFAmru.execmd.execmd.execsrss.exe

description	pid	process	target process
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4644 wrote to memory of 4588	4644	Uni400uni.exe	regasm.exe
PID 4588 wrote to memory of 3956	4588	regasm.exe	f8d6vyf8CcSsVmBPvqBWroL6.exe
PID 4588 wrote to memory of 3956	4588	regasm.exe	f8d6vyf8CcSsVmBPvqBWroL6.exe
PID 4588 wrote to memory of 3956	4588	regasm.exe	f8d6vyf8CcSsVmBPvqBWroL6.exe
PID 4588 wrote to memory of 3456	4588	regasm.exe	v658B7mgvx5DYbvRJJudn1dI.exe
PID 4588 wrote to memory of 3456	4588	regasm.exe	v658B7mgvx5DYbvRJJudn1dI.exe
PID 4588 wrote to memory of 3456	4588	regasm.exe	v658B7mgvx5DYbvRJJudn1dI.exe
PID 4588 wrote to memory of 1224	4588	regasm.exe	UD7KToN3dwJ6jD7So0SFAmru.exe
PID 4588 wrote to memory of 1224	4588	regasm.exe	UD7KToN3dwJ6jD7So0SFAmru.exe
PID 4588 wrote to memory of 1224	4588	regasm.exe	UD7KToN3dwJ6jD7So0SFAmru.exe
PID 3956 wrote to memory of 4480	3956	f8d6vyf8CcSsVmBPvqBWroL6.exe	u31w.0.exe
PID 3956 wrote to memory of 4480	3956	f8d6vyf8CcSsVmBPvqBWroL6.exe	u31w.0.exe
PID 3956 wrote to memory of 4480	3956	f8d6vyf8CcSsVmBPvqBWroL6.exe	u31w.0.exe
PID 1224 wrote to memory of 528	1224	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1224 wrote to memory of 528	1224	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1224 wrote to memory of 528	1224	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 3456 wrote to memory of 4776	3456	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 3456 wrote to memory of 4776	3456	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 3456 wrote to memory of 4776	3456	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 4608	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 4608	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 4608	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1364 wrote to memory of 2408	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 2408	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 2408	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1828 wrote to memory of 4156	1828	v658B7mgvx5DYbvRJJudn1dI.exe	cmd.exe
PID 1828 wrote to memory of 4156	1828	v658B7mgvx5DYbvRJJudn1dI.exe	cmd.exe
PID 4156 wrote to memory of 1508	4156	cmd.exe	netsh.exe
PID 4156 wrote to memory of 1508	4156	cmd.exe	netsh.exe
PID 1364 wrote to memory of 2412	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	cmd.exe
PID 1364 wrote to memory of 2412	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	cmd.exe
PID 2412 wrote to memory of 2504	2412	cmd.exe	netsh.exe
PID 2412 wrote to memory of 2504	2412	cmd.exe	netsh.exe
PID 1364 wrote to memory of 3760	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 3760	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 3760	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1828 wrote to memory of 4640	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 4640	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 4640	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 5232	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 5232	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1828 wrote to memory of 5232	1828	v658B7mgvx5DYbvRJJudn1dI.exe	powershell.exe
PID 1364 wrote to memory of 5224	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 5224	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 5224	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	powershell.exe
PID 1364 wrote to memory of 5684	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	csrss.exe
PID 1364 wrote to memory of 5684	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	csrss.exe
PID 1364 wrote to memory of 5684	1364	UD7KToN3dwJ6jD7So0SFAmru.exe	csrss.exe
PID 5684 wrote to memory of 5804	5684	csrss.exe	powershell.exe
PID 5684 wrote to memory of 5804	5684	csrss.exe	powershell.exe
PID 5684 wrote to memory of 5804	5684	csrss.exe	powershell.exe
PID 5684 wrote to memory of 4184	5684	csrss.exe	powershell.exe
PID 5684 wrote to memory of 4184	5684	csrss.exe	powershell.exe
PID 5684 wrote to memory of 4184	5684	csrss.exe	powershell.exe
PID 4588 wrote to memory of 4776	4588	regasm.exe	FMAe74ffrvL7ajt27hKSKYDR.exe
PID 4588 wrote to memory of 4776	4588	regasm.exe	FMAe74ffrvL7ajt27hKSKYDR.exe
PID 5684 wrote to memory of 5460	5684	csrss.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Uni400uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni400uni.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\Pictures\f8d6vyf8CcSsVmBPvqBWroL6.exe
"C:\Users\Admin\Pictures\f8d6vyf8CcSsVmBPvqBWroL6.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956

C:\Users\Admin\AppData\Local\Temp\u31w.0.exe
"C:\Users\Admin\AppData\Local\Temp\u31w.0.exe"
4⤵
- Executes dropped EXE
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1048
5⤵
- Program crash
PID:4316

C:\Users\Admin\Pictures\v658B7mgvx5DYbvRJJudn1dI.exe
"C:\Users\Admin\Pictures\v658B7mgvx5DYbvRJJudn1dI.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Users\Admin\Pictures\v658B7mgvx5DYbvRJJudn1dI.exe
"C:\Users\Admin\Pictures\v658B7mgvx5DYbvRJJudn1dI.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:1508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Users\Admin\Pictures\UD7KToN3dwJ6jD7So0SFAmru.exe
"C:\Users\Admin\Pictures\UD7KToN3dwJ6jD7So0SFAmru.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Users\Admin\Pictures\UD7KToN3dwJ6jD7So0SFAmru.exe
"C:\Users\Admin\Pictures\UD7KToN3dwJ6jD7So0SFAmru.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:2504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:6088

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:6116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5992

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:316

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Users\Admin\Pictures\FMAe74ffrvL7ajt27hKSKYDR.exe
"C:\Users\Admin\Pictures\FMAe74ffrvL7ajt27hKSKYDR.exe"
3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4480 -ip 4480
1⤵
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5552

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
a6ea7bfcd3aac150c0caef765cb52281

SHA1
037dc22c46a0eb0b9ad4c74088129e387cffe96b

SHA256
f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

SHA512
c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
21KB

MD5
dfd2b5651843bd6328a7d611c86f55ea

SHA1
f427ab99b22d2a7554d2bc11988f531bfcc9134e

SHA256
621406cd2b016a2f1207746fc7aaa7060774082e845246597d17f021a74180e5

SHA512
a674f19e6736f7838ccadb5a1e218872c34554d244ced606297445b5355766b32ec8e331d417c3385986625fabfc928bd2a88e5324e100ddd8d5966d13e05729

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3rtrmar.s3c.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\u31w.0.exe
Filesize
323KB

MD5
1d4341aa0ca4aefcb043d19eb205d8ac

SHA1
c6e7a063a22e6bad72b2c81017747ab31cb59579

SHA256
42af762221074082dc3aa6e4efdc2b6439cc026d6e94d6eeae97fcfafda272b4

SHA512
1bcc133000feb1ab7944295a14601ff1a66432dcbe117e9e60c9f98cb8aee5b28f0ddcbbc25e2b6d91b677ca67de32a8930a1317de9b8be17524a9bea43c73a7

Download Submit
C:\Users\Admin\Pictures\FMAe74ffrvL7ajt27hKSKYDR.exe
Filesize
3.9MB

MD5
ffee05ea98b1d51026a44fad0841a8a9

SHA1
50a703329c7b9812c17a02b554cf406040079fec

SHA256
4cb040696b9ffb14794955b0e56eed04fde0cae3a5ee748dd513ad42c411c823

SHA512
626ddc18a906b74a231daa5bcc092a90708e0e3d42e4db645d59d19de7ef38a2d91a843f11dbc7873d379bfa14e87c5fc6d09a657e0b44abd24b9991cb971f86

Download Submit
C:\Users\Admin\Pictures\LfzRHB0ET9iBCs79gvTRy2iG.exe
Filesize
7KB

MD5
5b423612b36cde7f2745455c5dd82577

SHA1
0187c7c80743b44e9e0c193e993294e3b969cc3d

SHA256
e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

SHA512
c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

Download Submit
C:\Users\Admin\Pictures\f8d6vyf8CcSsVmBPvqBWroL6.exe
Filesize
445KB

MD5
962689a584907a91344cd3427b586a04

SHA1
662bccdb6bd35082045778a68361dd3bf849dd57

SHA256
6abeb832e0ebffa3c8f166620d0aba275c0d51c4f75465e79a85716aead44cb4

SHA512
c9fa49f5c86498857c78ca833c847758b0e8b61db68454a5a5b3950332ac3f7238606f0ead0b1c288fcf82f7e450fb90b07f8770badac376bb8786caa755f6cb

Download Submit
C:\Users\Admin\Pictures\v658B7mgvx5DYbvRJJudn1dI.exe
Filesize
4.2MB

MD5
12c1251ddacc8c6651573aaae2a36711

SHA1
aa4a4fc95f24a847f33a0fcc22d318fe947929d0

SHA256
a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22

SHA512
e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
c967d8c293212d6471ab5d36d15019ea

SHA1
406757b02966a0febd23481ca69ec6e48dc57198

SHA256
5d4e396d4688c228875d05fe1bd56c85c11a221a04194e1e0e70227a66342aed

SHA512
c227bd16c0c5086f7c2472132f5c1405a1d74f25d896269c08d0dfe4bd9d26f79801b299f1c20ca868c91766a9cd76d57be79eb303d149f06b62d270a672f5cf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
927a97b5c6fbaff3bae367cf7898772d

SHA1
b58515d5c2080da48fbd1cd5080ecff687c64c8c

SHA256
d0e4f39083a1aaa997abb9517aa003f2cdcb59af9bdc82b517c49df2a288c497

SHA512
c98bd78729a316b316cad79e1318d0919d8a9a79e1fc463b8f5eaa2e19a93c50dd4b17cd3dc7b2a9926b9761b11aa1453835695318303671d9c0de8739ac23d7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
cc38260a1211e0037df90399bbace95f

SHA1
5f53489f4c137164fb0ff3ff2750655ca46b22da

SHA256
757a538f49b1d0035dbf6da871bb04d16cf82f5b63c40b6c49412b1acf47f194

SHA512
639a714cbc272a9fdd5f034c822d0cce6e8eb467b836051d5100771533b2fe99317ce80c23a2427d8e643a9e33bda939c9566796ed9cd3e68087046a9aecc640

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e98c38454d89188b68b7612d8b8307a6

SHA1
683e6c07d198e05531a7f1f174f7ece1f3ff841f

SHA256
9f4c676f3249073211853d366d3f604a4bb41a811e93b1a97898eac2e5b72797

SHA512
86bd5890f0a7587be352cb7b680c48629be712c38c4a8226f275b0c4711888e3b655724d4d2a714d64d02ebb54ef57c0bfbb043a0f82dbeb380dafc53d22b7b9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
aa06a819c9c754316a5d468ae4ea5ff9

SHA1
4857e0e6e06a474abf18049354573e698a60e0e4

SHA256
9d11b28a95054febc917b2b336df5546b48879be5721a85a26af400540a26b96

SHA512
65a569d7519e5273e1b8f1614908849cc507525f715ce216d25e83661de46486d96683d6582bf8a8f3845fc00a5a5b74d74983a9695ccac6d7ade7bc79b6aed4

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/528-113-0x00000000082A0000-0x000000000891A000-memory.dmp

Filesize
6.5MB

Download
memory/528-115-0x000000007F6E0000-0x000000007F6F0000-memory.dmp

Filesize
64KB

Download
memory/528-80-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/528-82-0x0000000005970000-0x0000000005F98000-memory.dmp

Filesize
6.2MB

Download
memory/528-161-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/528-158-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/528-156-0x0000000007FC0000-0x0000000007FD4000-memory.dmp

Filesize
80KB

Download
memory/528-85-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/528-155-0x0000000007FB0000-0x0000000007FBE000-memory.dmp

Filesize
56KB

Download
memory/528-79-0x00000000052A0000-0x00000000052D6000-memory.dmp

Filesize
216KB

Download
memory/528-152-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/528-148-0x0000000008010000-0x00000000080A6000-memory.dmp

Filesize
600KB

Download
memory/528-132-0x0000000007F50000-0x0000000007F5A000-memory.dmp

Filesize
40KB

Download
memory/528-131-0x0000000007E60000-0x0000000007F03000-memory.dmp

Filesize
652KB

Download
memory/528-129-0x0000000007E40000-0x0000000007E5E000-memory.dmp

Filesize
120KB

Download
memory/528-130-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/528-118-0x000000006E260000-0x000000006E5B4000-memory.dmp

Filesize
3.3MB

Download
memory/528-112-0x0000000007BA0000-0x0000000007C16000-memory.dmp

Filesize
472KB

Download
memory/528-117-0x000000006F690000-0x000000006F6DC000-memory.dmp

Filesize
304KB

Download
memory/528-114-0x0000000007C40000-0x0000000007C5A000-memory.dmp

Filesize
104KB

Download
memory/528-116-0x0000000007E00000-0x0000000007E32000-memory.dmp

Filesize
200KB

Download
memory/1224-153-0x0000000003A50000-0x0000000003E53000-memory.dmp

Filesize
4.0MB

Download
memory/1224-64-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1224-173-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1224-60-0x0000000003A50000-0x0000000003E53000-memory.dmp

Filesize
4.0MB

Download
memory/1364-363-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1364-174-0x0000000003950000-0x0000000003D51000-memory.dmp

Filesize
4.0MB

Download
memory/1364-186-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1828-362-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1828-366-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/1828-171-0x0000000003C00000-0x0000000004007000-memory.dmp

Filesize
4.0MB

Download
memory/1828-175-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/2412-509-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3456-59-0x0000000003B00000-0x0000000003F08000-memory.dmp

Filesize
4.0MB

Download
memory/3456-63-0x0000000003F10000-0x00000000047FB000-memory.dmp

Filesize
8.9MB

Download
memory/3456-61-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/3456-172-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/3456-154-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/3456-151-0x0000000003B00000-0x0000000003F08000-memory.dmp

Filesize
4.0MB

Download
memory/3956-146-0x0000000001C50000-0x0000000001D50000-memory.dmp

Filesize
1024KB

Download
memory/3956-136-0x00000000036F0000-0x000000000375E000-memory.dmp

Filesize
440KB

Download
memory/3956-27-0x0000000001C50000-0x0000000001D50000-memory.dmp

Filesize
1024KB

Download
memory/3956-150-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/3956-30-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/3956-28-0x00000000036F0000-0x000000000375E000-memory.dmp

Filesize
440KB

Download
memory/4480-77-0x0000000003630000-0x0000000003657000-memory.dmp

Filesize
156KB

Download
memory/4480-78-0x0000000000400000-0x0000000001A1C000-memory.dmp

Filesize
22.1MB

Download
memory/4480-76-0x0000000001B10000-0x0000000001C10000-memory.dmp

Filesize
1024KB

Download
memory/4480-108-0x0000000000400000-0x0000000001A1C000-memory.dmp

Filesize
22.1MB

Download
memory/4588-2-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4588-1-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4588-133-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4588-119-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4608-176-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/4608-187-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4776-432-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-147-0x00000000034E0000-0x00000000034F0000-memory.dmp

Filesize
64KB

Download
memory/4776-438-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-135-0x000000006E260000-0x000000006E5B4000-memory.dmp

Filesize
3.3MB

Download
memory/4776-439-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-134-0x000000006F690000-0x000000006F6DC000-memory.dmp

Filesize
304KB

Download
memory/4776-111-0x0000000006D50000-0x0000000006D94000-memory.dmp

Filesize
272KB

Download
memory/4776-440-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-109-0x0000000006810000-0x000000000682E000-memory.dmp

Filesize
120KB

Download
memory/4776-107-0x0000000006340000-0x0000000006694000-memory.dmp

Filesize
3.3MB

Download
memory/4776-87-0x00000000061D0000-0x0000000006236000-memory.dmp

Filesize
408KB

Download
memory/4776-165-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4776-149-0x0000000007EE0000-0x0000000007EF1000-memory.dmp

Filesize
68KB

Download
memory/4776-157-0x0000000008020000-0x000000000803A000-memory.dmp

Filesize
104KB

Download
memory/4776-110-0x0000000006840000-0x000000000688C000-memory.dmp

Filesize
304KB

Download
memory/4776-442-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-88-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4776-86-0x0000000006160000-0x00000000061C6000-memory.dmp

Filesize
408KB

Download
memory/4776-84-0x0000000005830000-0x0000000005852000-memory.dmp

Filesize
136KB

Download
memory/4776-83-0x00000000034E0000-0x00000000034F0000-memory.dmp

Filesize
64KB

Download
memory/4776-500-0x00007FF630600000-0x00007FF631109000-memory.dmp

Filesize
11.0MB

Download
memory/4776-81-0x00000000034E0000-0x00000000034F0000-memory.dmp

Filesize
64KB

Download
memory/5684-499-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/5684-514-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download
memory/5684-521-0x0000000000400000-0x0000000001DF9000-memory.dmp

Filesize
26.0MB

Download