glupteba | a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpimu4b6l1.exe
Size 9.1MB
Sample260522-1p9lsshx71
SHA256 a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401
MD5 c22eabee5e50ca520f023dc176280533
SHA1 7ef2e8be12543a8c190396054c2c843685043d23
SHA512 086cc096477dc3a1db62a4e26d0e5ba0ee6d337a143186294f500313f733a63f28c8af0b16b0e9076f1d0e5d7682055b0c3c7e1345eadd49220ce71a40497b57
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iqY:sxEvYjVzANghwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000243fb-109.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4736	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4116	csrss.exe
4668	csrss.exe
3048	csrss.exe
4368	csrss.exe
1428	csrss.exe
2636	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpimu4b6l1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpimu4b6l1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpimu4b6l1.exe
File created	C:\Windows\rss\csrss.exe	tmpimu4b6l1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe
4752	powershell.exe
2296	powershell.exe
2204	powershell.exe
4952	powershell.exe
4924	powershell.exe
4984	powershell.exe
532	powershell.exe
5020	powershell.exe
4468	powershell.exe
1584	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpimu4b6l1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpimu4b6l1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4400	schtasks.exe
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
532	powershell.exe
532	powershell.exe
2328	tmpimu4b6l1.exe
2328	tmpimu4b6l1.exe
3220	powershell.exe
3220	powershell.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
3564	tmpimu4b6l1.exe
5020	powershell.exe
5020	powershell.exe
4752	powershell.exe
4752	powershell.exe
4468	powershell.exe
4468	powershell.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
4468	powershell.exe
4668	csrss.exe
4668	csrss.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
4368	csrss.exe
4368	csrss.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
4116	csrss.exe
4116	csrss.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe
4116	csrss.exe
4116	csrss.exe
2636	injector.exe
2636	injector.exe
2636	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	2328	tmpimu4b6l1.exe
Token: SeImpersonatePrivilege	2328	tmpimu4b6l1.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	4668	csrss.exe
Token: SeImpersonatePrivilege	4668	csrss.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4368	csrss.exe
Token: SeImpersonatePrivilege	4368	csrss.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeSystemEnvironmentPrivilege	4116	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 532	2328	tmpimu4b6l1.exe	90
PID 3564 wrote to memory of 3220	3564	tmpimu4b6l1.exe	96
PID 3564 wrote to memory of 4892	3564	tmpimu4b6l1.exe	98
PID 4892 wrote to memory of 4736	4892	cmd.exe	100
PID 3564 wrote to memory of 5020	3564	tmpimu4b6l1.exe	101
PID 3564 wrote to memory of 4752	3564	tmpimu4b6l1.exe	103
PID 3564 wrote to memory of 4116	3564	tmpimu4b6l1.exe	105
PID 4116 wrote to memory of 4468	4116	csrss.exe	107
PID 4668 wrote to memory of 2296	4668	csrss.exe	110
PID 3048 wrote to memory of 2204	3048	csrss.exe	113
PID 4116 wrote to memory of 1584	4116	csrss.exe	119
PID 4368 wrote to memory of 4952	4368	csrss.exe	129
PID 4116 wrote to memory of 4924	4116	csrss.exe	131
PID 1428 wrote to memory of 4984	1428	csrss.exe	134
PID 4116 wrote to memory of 2636	4116	csrss.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe
"C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:532
- C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4400
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2636
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4940

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 1f668545b0cdeff4d671441514f241efbc0a9eb792b94d44743f8388fd4df72c
MD5 0cefa4a49398298e0a7e6eb8862191a4
SHA1 75a66dbff0faaaf94f00129a3563cbbd373fb57a
SHA512 8d47e360584e546e3f08c3ae9c43575c187d7b87a34fcdad7e539216dc008a50e86ea331b0aad7b2f2508840b0c28e375560da8bb93828e1de0690451d38dd8d
SSDEEP 384:zsf+hoW9i+DWsN3rWJk/Qo9o2TVK6seYbneKx/xoYqLYbLU0uF5rt9K6A/9JDAYH:IfAvnF/lo2TVN+nF0Y/Xcrt9ibOKcM
TLSH
T130A2E75E619F1AC3C4865378D10A041FE8F2DD8D431927D8BB1F8F7B8AAC6BE6178548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 7e8407c891aaaac7837f4dac7b8251b4d1fcf3ce03314219ef9c51361e3928ef
MD5 7425940be1455e1539154b444affc3fa
SHA1 86d8c8daa578937ecf55ab038a80e25500e1da11
SHA512 0363bf360ae0bd4be8e684d7a18f40e9b89428ad6a5e414b9edd8925289b89d2d26ccc3f4f81ea7044edfde8984757c63f027d858f2d7dc239cdbb3a38444461
SSDEEP 384:46+ho391JUpO5SBiGJk+o9oEFK6smOFNpfNrJ39cFjsX0YoUIrJe4WKm63x9Dh+R:5AYJxsobjoEFLOFNpf1cFQ+U0EH/CLRo
TLSH
T170A23A4A621F2AD7C19A23B8C43A43EFD9B0CCDF830017DD778A59371686A7554F92E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ttaawbbr.xqg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttaawbbr.xqg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c6de67800dd62632cfb8d3959ef2fd707789910076f2040e504b5053f88c3876
MD5 284506e491fda231457e8cc1d0d91f13
SHA1 0d6da9fb68f2e5dfe751dab40cadf502993ac314
SHA512 b917924dbd097b9e6b76b87d8a04b3af976b3aad095e11c55d5d72417047ba0d2d5311b811293e32ffcb1b13caa8199cb8045b6be3643275a4bc8fe73ff29d37
SSDEEP 384:Ksf+Bm9RBriGNBizijfD/f9oKjWKNYFFjffemFc7/IOGPMVJO1zr+nFbOuj3lPsV:3fJrdo6fRoKj7N8Fjffo7WEY1u4ublE
TLSH
T1F392189D621F3AD7C0A613B4C42B43ABDDB09DCF830407DE568A6E3706CA7B548981E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 4515aab6979048c617bbaff9819f7954101c2ebfd970288bd0e06a8029baf679
MD5 92b1efdf5a1bfbcc59a5ba7575058da9
SHA1 b65c022c848a7a14de028ac32069df5a643f69cd
SHA512 bc34484f67faf15b4b1900082eb493c1e65961d4d2746ebd5309f95dda3410a6729f2e651fd9c827d56371dd5e15b9e5b57447942781743f97212c0d8d839541
SSDEEP 384:Ksf+BHRBD/f7tvtJklfto9o2TVK6seYPNpfNWUOMckT1Ytdz1zj1rP+nFbOuj3lT:3fEz5v8lmo2TVNiNpf8xUUt1zs4ublT
TLSH
T16A924B5D222F3A97C4AA23F8D43643DBDA309DDF930007DD168A293B06CA77194E95F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 644fbb8c88c430a043d69497179127eb3d32253fb27287cfb6f94096c7b12ce8
MD5 11ad0101e3ec7194861d31c549d7b442
SHA1 d289604c62051031b07477d24946f1446650c77f
SHA512 84ab8fd5912b6892521904b32d2dec77c21e4c93dddc6c14a0fbdf22198024ec05cec67e044efb6424bb3b55975f39936b950db9ecd4ae3eb280a96c90e248d6
SSDEEP 384:Ysf+BHRB7L5oIBBihG/kz+o9LUNYFFNpfN1k7/ZMcmMKMloIQ1CY+nFbOuj3lusV:1fE3LohtzjLUN8FNpfQ7FUUa1o4ublj
TLSH
T1EE92185E621F2A97D46522F8D02A07DFE9B0AECFC38007DD57441E3B06CA77694E91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 7873c1d0299bc1cb0f66aafb4af2181c7aee0ce289a3f61e0ec0b7a768d084ee
MD5 b9a50d6851e899511c5acc00e49a7c17
SHA1 cefea62e4ae835e6582e23d71a86f18b3763d3e1
SHA512 86b5846d9e149105c4822e852a8a592c848f25a73a53c2d863a40e5d0a36c8c8c9f5e4a7b0f3c2ae05e30436c2fcc10d1c2e7245a699bd7d104f69c4d2c20d95
SSDEEP 384:M6+BnRBeW0pF/GHZgvFzbmK6seYFFjffempw7/ZGaMRdp1EB+nFbOuj3ld2Og:tMeW0PuHSON8Fjffg7bIP1b4ublc
TLSH
T19E92185D221F2AD6E06213F4D42A0B9FF9F09DCFC38006DD57851D3B06DA77A44A92E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 50f0aa9d33fe316eee1d46bf42b4b21eacde4317cd8bf5b6ac556b63922e645d
MD5 3d2cc6eda5210fa4f2fc75eaad590ba6
SHA1 17690f79601badaef3d75f4d5d61c08edaecf91d
SHA512 4084e8b18f2037816d41e22d88ab2f26a97bcfea5d22c318ed7dbc3cb37be83b678ddc50578bd72de97f53735b9c8318601c184189d48cc79b196724b3aecd18
SSDEEP 384:9sf+Bm9m+nfJD3BFCnk+o9o2TVK6seYbnei8v/ZFwMHVOuEIjaL0LZbObTUSyR:if3fJrXljo2TVN+n4vxOuEI5FqMdR
TLSH
T1B092E76D611F16C3C4861378E117054FE8F2DE8D531A07D8BB2E9F3B8AACA9E913C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e20ab692c3d103a5393ed40d4f59a611a5d82a183cea27a39cb741775d3fe7de
MD5 577b5a07d821e5767ec1e245772598f0
SHA1 c48d5d0b30e23bdd044bced7f3aa73493f18b27d
SHA512 14c179d24ec479e461b3ab73eeac2c5ccada75d8bbe3f9fe9db253cee0545e3c495d771d54a10819580c29f2b082fc98dbab5904b13ed6ee380cd04f3b06980d
SSDEEP 384:Z6+Bm9RBVSW8aES2p5NFwNYPjffemdc7/IOqaM1JG1zq+nFbOuj3ljcOg:4JP8vS2jNFwNijff47fkw1j4ublQ
TLSH
T17D92275D221F2A96E06213F4C02A4BEFF9F09DCFC34007ED57855E3B06DA2B594A81E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401
MD5 c22eabee5e50ca520f023dc176280533
SHA1 7ef2e8be12543a8c190396054c2c843685043d23
SHA512 086cc096477dc3a1db62a4e26d0e5ba0ee6d337a143186294f500313f733a63f28c8af0b16b0e9076f1d0e5d7682055b0c3c7e1345eadd49220ce71a40497b57
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iqY:sxEvYjVzANghwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-35-0x00000000074E0000-0x0000000007583000-memory.dmp

Download

memory/532-41-0x0000000007730000-0x000000000774A000-memory.dmp

Download

memory/532-21-0x0000000007480000-0x00000000074B2000-memory.dmp

Download

memory/532-22-0x0000000070540000-0x000000007058C000-memory.dmp

Download

memory/532-26-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/532-25-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/532-24-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/532-23-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/532-34-0x00000000074C0000-0x00000000074DE000-memory.dmp

Download

memory/532-18-0x0000000007920000-0x0000000007F9A000-memory.dmp

Download

memory/532-36-0x00000000075D0000-0x00000000075DA000-memory.dmp

Download

memory/532-37-0x0000000007690000-0x0000000007726000-memory.dmp

Download

memory/532-38-0x00000000075F0000-0x0000000007601000-memory.dmp

Download

memory/532-39-0x0000000007630000-0x000000000763E000-memory.dmp

Download

memory/532-40-0x0000000007640000-0x0000000007654000-memory.dmp

Download

memory/532-20-0x000000007F4F0000-0x000000007F500000-memory.dmp

Download

memory/532-42-0x0000000007670000-0x0000000007678000-memory.dmp

Download

memory/532-19-0x00000000072C0000-0x00000000072DA000-memory.dmp

Download

memory/532-17-0x0000000007220000-0x0000000007296000-memory.dmp

Download

memory/532-16-0x0000000006450000-0x0000000006494000-memory.dmp

Download

memory/532-1-0x0000000004930000-0x0000000004966000-memory.dmp

Download

memory/532-15-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Download

memory/532-2-0x00000000050A0000-0x00000000056C8000-memory.dmp

Download

memory/532-4-0x0000000005740000-0x00000000057A6000-memory.dmp

Download

memory/532-14-0x0000000005F00000-0x0000000005F1E000-memory.dmp

Download

memory/532-0-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/532-13-0x00000000058E0000-0x0000000005C34000-memory.dmp

Download

memory/532-3-0x0000000005030000-0x0000000005052000-memory.dmp

Download

memory/532-5-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/1584-183-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/1584-184-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/1584-202-0x0000000005830000-0x0000000005844000-memory.dmp

Download

memory/2204-163-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/2204-161-0x0000000005F30000-0x0000000006284000-memory.dmp

Download

memory/2204-192-0x00000000062B0000-0x00000000062C4000-memory.dmp

Download

memory/2204-182-0x0000000007A40000-0x0000000007A51000-memory.dmp

Download

memory/2204-171-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/2204-180-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/2204-172-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/2296-141-0x0000000070C50000-0x0000000070FA4000-memory.dmp

Download

memory/2296-140-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/2296-150-0x00000000053F0000-0x0000000005404000-memory.dmp

Download

memory/2296-129-0x00000000061E0000-0x000000000622C000-memory.dmp

Download

memory/3220-65-0x00000000076F0000-0x0000000007704000-memory.dmp

Download

memory/3220-54-0x0000000070640000-0x000000007068C000-memory.dmp

Download

memory/3220-55-0x0000000070DE0000-0x0000000071134000-memory.dmp

Download

memory/3220-63-0x0000000007380000-0x0000000007423000-memory.dmp

Download

memory/3220-52-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Download

memory/3220-53-0x00000000061D0000-0x000000000621C000-memory.dmp

Download

memory/3220-64-0x00000000076A0000-0x00000000076B1000-memory.dmp

Download

memory/4468-139-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/4468-131-0x0000000070C50000-0x0000000070FA4000-memory.dmp

Download

memory/4468-130-0x00000000705A0000-0x00000000705EC000-memory.dmp

Download

memory/4468-149-0x0000000006270000-0x0000000006281000-memory.dmp

Download

memory/4468-112-0x0000000005DD0000-0x0000000006124000-memory.dmp

Download

memory/4752-96-0x0000000070640000-0x000000007068C000-memory.dmp

Download

memory/4752-97-0x0000000070DE0000-0x0000000071134000-memory.dmp

Download

memory/4924-243-0x0000000005790000-0x00000000057A4000-memory.dmp

Download

memory/4924-224-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/4924-225-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/4952-223-0x0000000007E20000-0x0000000007E31000-memory.dmp

Download

memory/4952-222-0x0000000007CF0000-0x0000000007D93000-memory.dmp

Download

memory/4952-214-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/4952-213-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/4952-233-0x0000000006510000-0x0000000006524000-memory.dmp

Download

memory/4984-245-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/4984-246-0x0000000070660000-0x00000000709B4000-memory.dmp

Download

memory/5020-78-0x0000000070640000-0x000000007068C000-memory.dmp

Download

memory/5020-76-0x00000000064E0000-0x0000000006834000-memory.dmp

Download

memory/5020-79-0x00000000707C0000-0x0000000070B14000-memory.dmp

Download