glupteba | bbfa3271bc782b462405c2fc4eebf0906b40005209a0c0a20214996ed87c1444

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpqe4_b5tq.exe
Size 4.2MB
Sample260522-1synpsfs9p
SHA256 bbfa3271bc782b462405c2fc4eebf0906b40005209a0c0a20214996ed87c1444
MD5 fe1719575d4bbb87cd9bab5bd032dced
SHA1 27a1e33e4967faf276eac040b97b77b07266c30d
SHA512 954d3dad3be59304a1cc1362652392a00bf771be0efd365fe19e598f6ae1e4f06d9875027294ad8c980d6d4ed07ba837b94d4eada5d6cb2bf6809f975a534050
SSDEEP 98304:LwI55FRIfsmtYhw63zMBnKz9mF45iI1/h9:Ln55zQC3zMBnKzsIxL
TLSH
T15E163340F2A19863ED3A477A493A85E8676ABD265B34C68E7294376F1FF31F01831F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 17 IoCs

resource	yara_rule
behavioral3/memory/664-2-0x00000000052C0000-0x0000000005BAB000-memory.dmp	family_glupteba
behavioral3/memory/664-20-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/664-49-0x00000000052C0000-0x0000000005BAB000-memory.dmp	family_glupteba
behavioral3/memory/664-50-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2740-109-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2132-132-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-196-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2132-197-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-199-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-202-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-205-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-233-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2148-249-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/924-250-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-252-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/2600-257-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba
behavioral3/memory/3704-278-0x0000000000400000-0x0000000002EE9000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2968	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2600	csrss.exe
2132	csrss.exe
2148	csrss.exe
924	csrss.exe
4612	injector.exe
3704	csrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpqe4_b5tq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpqe4_b5tq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpqe4_b5tq.exe
File created	C:\Windows\rss\csrss.exe	tmpqe4_b5tq.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1952	powershell.exe
4296	powershell.exe
244	powershell.exe
2456	powershell.exe
2464	powershell.exe
1444	powershell.exe
4976	powershell.exe
2768	powershell.exe
3160	powershell.exe
3500	powershell.exe
4672	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpqe4_b5tq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpqe4_b5tq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2152	schtasks.exe
5012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	powershell.exe
1952	powershell.exe
664	tmpqe4_b5tq.exe
664	tmpqe4_b5tq.exe
4296	powershell.exe
4296	powershell.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
2740	tmpqe4_b5tq.exe
244	powershell.exe
244	powershell.exe
4976	powershell.exe
4976	powershell.exe
2768	powershell.exe
2456	powershell.exe
2456	powershell.exe
2768	powershell.exe
2132	csrss.exe
2132	csrss.exe
2464	powershell.exe
2464	powershell.exe
1444	powershell.exe
1444	powershell.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
2600	csrss.exe
2600	csrss.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
2600	csrss.exe
2600	csrss.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe
4612	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	664	tmpqe4_b5tq.exe
Token: SeImpersonatePrivilege	664	tmpqe4_b5tq.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2132	csrss.exe
Token: SeImpersonatePrivilege	2132	csrss.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeSystemEnvironmentPrivilege	2600	csrss.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	924	csrss.exe
Token: SeImpersonatePrivilege	924	csrss.exe
Token: SeDebugPrivilege	4672	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 1952	664	tmpqe4_b5tq.exe	81
PID 2740 wrote to memory of 4296	2740	tmpqe4_b5tq.exe	86
PID 2740 wrote to memory of 1652	2740	tmpqe4_b5tq.exe	88
PID 1652 wrote to memory of 2968	1652	cmd.exe	90
PID 2740 wrote to memory of 244	2740	tmpqe4_b5tq.exe	91
PID 2740 wrote to memory of 4976	2740	tmpqe4_b5tq.exe	93
PID 2740 wrote to memory of 2600	2740	tmpqe4_b5tq.exe	95
PID 2600 wrote to memory of 2456	2600	csrss.exe	98
PID 2132 wrote to memory of 2768	2132	csrss.exe	100
PID 2600 wrote to memory of 2464	2600	csrss.exe	112
PID 2600 wrote to memory of 1444	2600	csrss.exe	117
PID 2600 wrote to memory of 4612	2600	csrss.exe	119
PID 924 wrote to memory of 3160	924	csrss.exe	123
PID 2148 wrote to memory of 3500	2148	csrss.exe	125
PID 3704 wrote to memory of 4672	3704	csrss.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe
"C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpqe4_b5tq.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2456
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2152
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4612
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5012

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:3500

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 9eec74a4b40060d8eec7756e11648a7f3b30445afda6b5086585a036266dc249
MD5 67188001fc8143b6bc2907855ff0d5e2
SHA1 4b23373c2ff7fcec1bcc721208f7f0e9492d6b2e
SHA512 f7b1d8c3a65a3d57d6a048076480d1adb9ddc85ef6d20b084d7a263d2d32760483b78fd9bc98e14715c5430e8370089851fafed14713e8bf766a8ed24ffc4c70
SSDEEP 384:LL3HhwmGS13x6zHLpFRHEMEs4cHDUNfjQGIALj5bsUjGayEID3iJILOj9tFK:/x3GSaPnRPEsBufjfIAL9bxGx9D3i2L/
TLSH
T16092D69E711F26C3C8C663B8D106040FE8F2DE8D031A56CDBB2E9F7B89AC59A517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 3547cd97487fc205fb2da8958c5cab1a3c7c9e34bd84ab8afc70a6a4806369ce
MD5 0bb10741acc7bbfe9d6b3fe69e96c8cf
SHA1 a51aacb9babc0a0bed0302c04d1b26cf49097ba8
SHA512 42586bd7605459fdd92ed4fc87537b378f1e114220878ee0b2e60828735a266700f97c5f38d635e7c58d99fadd7499c895543b838d363783aa80c799b727aa0a
SSDEEP 384:SXL3Hhwz1SS1Uj9S9cy6OuAZZ1nnNzRjQr2IGmeqMdq4Gexyb9iJYxLSnY9phAUT:UxISSCRS+7i1NFjvP5Vw84iWl99p2UT
TLSH
T1B2923B9D722F268BC4A953F9D432038FE5659DDF03049BDEA70A9C3B01CE66484B85EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bau4wodq.t0u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bau4wodq.t0u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b3056b1936ab2c74c1b7ab2428a7f504fe79f187f88e47cd31d84d44ed83b068
MD5 06c4d8d301ea6d4fdaa2a79ce5b9b0ce
SHA1 8875eda3c677fe1bfc727dc59c3d64cb24063b75
SHA512 39ccd2577cded869670fe15928001ce5aa507fcec0427c20fa8bf2e5a3749b6fac3615a5e4cd27c6653daaf2d52bec201ee775286db2f59ea068c7ba03b63047
SSDEEP 384:MTHhtOqtYjEL4IncGa2EGmmHnhjWa1ICeLNXjQHbrezvnY9jhUdAH:COqC04jj2EOhjWa1ICeLNzwbSzw9lUQ
TLSH
T12892396D226F2697D46513F8C0260B8BF9F08ACF834496DEA3195C3B05CF27594AD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 7e80d666803e4bcca41725402b9a45e6949a47ec84832c0b59bba5b938b02f1c
MD5 0ae707abf35e80ed55668fa05dc085c2
SHA1 a0dfe65329dd5d97e0987b7c944b9d9f951b23ef
SHA512 313a283bf55349647cb11b02863d2d6486bcc9ad21254473346c8525b2cbf344105a8aff963a19fa7d12ed17e9f93d172818b08834482145156e505eec2084b3
SSDEEP 384:WL3Hhz1S2kjj3fLAFRHEMEyHnn8aK2AFWMHmHE0E6iynY9jhUdkH:AvS3v3f0RPEy8aBAl6id9lU0
TLSH
T18092065D222F76ABC4AA23F8943617DFEE608DDF830493DE1648583B05CB67088995FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ec24df8e6cf77943c6e4e973e629c4f5b08b77e2234ca1459b9ac1268775182a
MD5 dae6cfaa922c2ba4f96aa97220ca5f9e
SHA1 eafe8d5c961740f979bbccc26005ffd19984c118
SHA512 703db80381ea7587960baaa4992f4cf6107695996615941b4b64b1eb0a10f670070c41e3539ca5fc643aef77f5405b6ffd597fca6df2cb1c25a5858ead3b443a
SSDEEP 384:2THhwSSf7Mp50RHfIM8eHn9jWa1ICmLNbq/HbLW6i7nY9jhUd4H:ZSSzgSRb9jWa1ICmLNEba6ik9lU8
TLSH
T15992186D226F2696E4A523F48016079FF9F08ECFC34452EE67196E3B06CF27154A84ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 905919b1c2a8a125eee003a341ed94cf19b3798f165ebc76af42a3a3894432ad
MD5 dc9963c61e53fdcbd439a74b339246b5
SHA1 64b2e7990089700c7573860aab249ee5d1ea41b5
SHA512 9ae1ddab5fcc0fab6f3d7289a0bea36dae23b8f9b15d62e9d971f2ac04329b74d1abbb072f28aed238d9aad87d5df1ca16bc474129339048983ce04f6f327b0e
SSDEEP 384:HL3HhwSStnKi3Q6FRHGVMxQ0nRjFK2EFpq4bnWzenY9jhUdtH:rKSSkwQ6Rm2GYjFBE/ZbWzB9lUf
TLSH
T18792076D222F26DBC4A923B9C022079FE9B08EDE434053EE5359693B45CB67094E95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 82748b757f05f5ed196de722adf14ad0366cb020a7bbf7c99f5bb3f221536d9b
MD5 36dc16f44c1814d94d62dac2b1f3e5b9
SHA1 5560a70b4d35384b7a1a9db22507504069614a6c
SHA512 5cd7584abe925bbfbe888982e9ac158de25a25e521c8cb98e81e6b9f1665b2f0b349e486dde1c84936f306a94d7f9eb8a89226d9e5ca7b62d86b4774dc575de2
SSDEEP 384:PTHhz1S2kjWSaxOGa2EHHNmnNjWaK2OLkoGDg+brDFS2nY9jhUd9H:zS3SSEOj2ENajWaBOLhGU+brDFC9lUr
TLSH
T16392275D222F169AE52163F8D0224B8FF9E06ACFC30096DE57144D3A06CF675E4E85F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5f15f3de7faf8fa5ed6a897250227fad197605bb00f4bb87f2735b024c2e7794
MD5 72020a452da4eb7ce04d645ce53b116f
SHA1 682d89ab95576fc863b4c179f2d690f03deb1561
SHA512 421d9a6e4f28be64f4daa11fc5dd9b91befa0b7e2f558cf8868288e3280a0ce7393afcbee9006b60ffa139456b455a084b9054a031f1c323a491c5c3fb9a859f
SSDEEP 384:GL3HhwWSJoNkwn4XFRHEME2HnnNzjQGII+NXjg2xZb3zHzkRjNadF+:wKWSCN81RPEGNzjfII+NzgCZb3zzkKdk
TLSH
T19792C6AE611F22C3C89553B8D10B050FE8F2DE8D431922D9BB2E9F7B89AC95E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 3f01eacdfbdca2ec6d1e66d5ffce175e76eb06b7fea49b96c73b25d9230ff399
MD5 1680306395f738ac5ef8c928ead87502
SHA1 52cd23bb82fdfd06cd2c14dd484aaac388d7a065
SHA512 46363242055fe61ad197784cc02e6a9ba65422c7b6419decae8d8e4d0dc0df6c6503fe76ea4fac09f637d14d32539a50eb901e560c7f7baf25eaba6889599c6a
SSDEEP 384:eTHhwSStYy3ZxHFlAiHhAeH/HNjWa1ICmLNXjUHbaz7nY9jhUdN7H:RSSlJxllAah3ljWa1ICmLNz0bazk9lUv
TLSH
T14B92396D226F26DBE49523F4C026079FFCF08ACEC38452DE53596D3B05CA27184A95ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.2MB
SHA256 bbfa3271bc782b462405c2fc4eebf0906b40005209a0c0a20214996ed87c1444
MD5 fe1719575d4bbb87cd9bab5bd032dced
SHA1 27a1e33e4967faf276eac040b97b77b07266c30d
SHA512 954d3dad3be59304a1cc1362652392a00bf771be0efd365fe19e598f6ae1e4f06d9875027294ad8c980d6d4ed07ba837b94d4eada5d6cb2bf6809f975a534050
SSDEEP 98304:LwI55FRIfsmtYhw63zMBnKz9mF45iI1/h9:Ln55zQC3zMBnKzsIxL
TLSH
T15E163340F2A19863ED3A477A493A85E8676ABD265B34C68E7294376F1FF31F01831F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-78-0x0000000006210000-0x0000000006567000-memory.dmp

Download

memory/244-81-0x0000000070ED0000-0x0000000071227000-memory.dmp

Download

memory/244-80-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/664-20-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/664-48-0x00000000038A0000-0x0000000003CA6000-memory.dmp

Download

memory/664-1-0x00000000038A0000-0x0000000003CA6000-memory.dmp

Download

memory/664-2-0x00000000052C0000-0x0000000005BAB000-memory.dmp

Download

memory/664-50-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/664-49-0x00000000052C0000-0x0000000005BAB000-memory.dmp

Download

memory/924-250-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/1444-182-0x0000000070EB0000-0x0000000071207000-memory.dmp

Download

memory/1444-179-0x0000000005E50000-0x00000000061A7000-memory.dmp

Download

memory/1444-181-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/1952-21-0x000000007F820000-0x000000007F830000-memory.dmp

Download

memory/1952-19-0x00000000065F0000-0x0000000006636000-memory.dmp

Download

memory/1952-40-0x0000000007650000-0x0000000007661000-memory.dmp

Download

memory/1952-41-0x00000000076A0000-0x00000000076AE000-memory.dmp

Download

memory/1952-42-0x00000000076B0000-0x00000000076C5000-memory.dmp

Download

memory/1952-43-0x0000000007700000-0x000000000771A000-memory.dmp

Download

memory/1952-44-0x0000000007720000-0x0000000007728000-memory.dmp

Download

memory/1952-38-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/1952-36-0x0000000007C30000-0x00000000082AA000-memory.dmp

Download

memory/1952-37-0x00000000075F0000-0x000000000760A000-memory.dmp

Download

memory/1952-25-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/1952-35-0x00000000074C0000-0x0000000007564000-memory.dmp

Download

memory/1952-3-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/1952-34-0x00000000074A0000-0x00000000074BE000-memory.dmp

Download

memory/1952-28-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/1952-32-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/1952-24-0x0000000070F00000-0x0000000071257000-memory.dmp

Download

memory/1952-23-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/1952-22-0x0000000007460000-0x0000000007494000-memory.dmp

Download

memory/1952-39-0x0000000007740000-0x00000000077D6000-memory.dmp

Download

memory/1952-18-0x00000000060D0000-0x000000000611C000-memory.dmp

Download

memory/1952-17-0x0000000006020000-0x000000000603E000-memory.dmp

Download

memory/1952-4-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Download

memory/1952-16-0x0000000005B00000-0x0000000005E57000-memory.dmp

Download

memory/1952-9-0x0000000005950000-0x00000000059B6000-memory.dmp

Download

memory/1952-8-0x0000000005200000-0x0000000005266000-memory.dmp

Download

memory/1952-5-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/1952-7-0x0000000005060000-0x0000000005082000-memory.dmp

Download

memory/1952-6-0x0000000005320000-0x000000000594A000-memory.dmp

Download

memory/2132-132-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2132-197-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2148-249-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2456-135-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/2456-136-0x0000000070F80000-0x00000000712D7000-memory.dmp

Download

memory/2456-119-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/2464-164-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/2464-165-0x0000000070F80000-0x00000000712D7000-memory.dmp

Download

memory/2600-205-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-257-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-252-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-233-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-202-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-196-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2600-199-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2740-109-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/2768-144-0x0000000070F80000-0x00000000712D7000-memory.dmp

Download

memory/2768-143-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/3160-244-0x00000000062B0000-0x00000000062C5000-memory.dmp

Download

memory/3160-235-0x0000000005E70000-0x0000000005E81000-memory.dmp

Download

memory/3160-222-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/3160-224-0x0000000070C70000-0x0000000070CBC000-memory.dmp

Download

memory/3160-225-0x0000000070DF0000-0x0000000071147000-memory.dmp

Download

memory/3160-232-0x00000000078E0000-0x0000000007984000-memory.dmp

Download

memory/3160-214-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/3500-236-0x0000000070C70000-0x0000000070CBC000-memory.dmp

Download

memory/3500-237-0x0000000070DF0000-0x0000000071147000-memory.dmp

Download

memory/3704-278-0x0000000000400000-0x0000000002EE9000-memory.dmp

Download

memory/4296-58-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/4296-57-0x00000000057C0000-0x0000000005B17000-memory.dmp

Download

memory/4296-59-0x0000000070F20000-0x0000000071277000-memory.dmp

Download

memory/4296-67-0x0000000007180000-0x0000000007191000-memory.dmp

Download

memory/4296-68-0x00000000071D0000-0x00000000071E5000-memory.dmp

Download

memory/4296-66-0x0000000006E50000-0x0000000006EF4000-memory.dmp

Download

memory/4672-264-0x0000000005F40000-0x0000000006297000-memory.dmp

Download

memory/4672-266-0x0000000006550000-0x000000000659C000-memory.dmp

Download

memory/4672-268-0x0000000070C30000-0x0000000070C7C000-memory.dmp

Download

memory/4672-269-0x0000000070DB0000-0x0000000071107000-memory.dmp

Download

memory/4672-276-0x00000000077A0000-0x0000000007844000-memory.dmp

Download

memory/4672-277-0x0000000007AF0000-0x0000000007B01000-memory.dmp

Download

memory/4672-279-0x0000000006330000-0x0000000006345000-memory.dmp

Download

memory/4976-97-0x0000000070ED0000-0x0000000071227000-memory.dmp

Download

memory/4976-96-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download