glupteba | d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmprgo6xq4g.exe
Size 9.1MB
Sample260522-1vxjeshy4x
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x004300000002af2d-101.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3716	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2860	csrss.exe
784	csrss.exe
2248	csrss.exe
4320	csrss.exe
3212	csrss.exe
1252	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmprgo6xq4g.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmprgo6xq4g.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmprgo6xq4g.exe
File created	C:\Windows\rss\csrss.exe	tmprgo6xq4g.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2836	powershell.exe
232	powershell.exe
4896	powershell.exe
4648	powershell.exe
3984	powershell.exe
2504	powershell.exe
576	powershell.exe
2696	powershell.exe
5012	powershell.exe
4556	powershell.exe
3964	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4848	schtasks.exe
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	powershell.exe
2836	powershell.exe
4396	tmprgo6xq4g.exe
4396	tmprgo6xq4g.exe
5012	powershell.exe
5012	powershell.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
1892	tmprgo6xq4g.exe
232	powershell.exe
232	powershell.exe
4896	powershell.exe
4896	powershell.exe
4648	powershell.exe
4648	powershell.exe
4556	powershell.exe
4556	powershell.exe
3984	powershell.exe
3984	powershell.exe
784	csrss.exe
784	csrss.exe
3964	powershell.exe
3964	powershell.exe
2504	powershell.exe
2504	powershell.exe
576	powershell.exe
576	powershell.exe
2248	csrss.exe
2248	csrss.exe
2696	powershell.exe
2696	powershell.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
2860	csrss.exe
2860	csrss.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
2860	csrss.exe
2860	csrss.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe
1252	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	4396	tmprgo6xq4g.exe
Token: SeImpersonatePrivilege	4396	tmprgo6xq4g.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	784	csrss.exe
Token: SeImpersonatePrivilege	784	csrss.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2248	csrss.exe
Token: SeImpersonatePrivilege	2248	csrss.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeSystemEnvironmentPrivilege	2860	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2836	4396	tmprgo6xq4g.exe	81
PID 1892 wrote to memory of 5012	1892	tmprgo6xq4g.exe	86
PID 1892 wrote to memory of 3896	1892	tmprgo6xq4g.exe	88
PID 3896 wrote to memory of 3716	3896	cmd.exe	90
PID 1892 wrote to memory of 232	1892	tmprgo6xq4g.exe	91
PID 1892 wrote to memory of 4896	1892	tmprgo6xq4g.exe	93
PID 1892 wrote to memory of 2860	1892	tmprgo6xq4g.exe	95
PID 2860 wrote to memory of 4648	2860	csrss.exe	96
PID 784 wrote to memory of 4556	784	csrss.exe	100
PID 2860 wrote to memory of 3984	2860	csrss.exe	106
PID 2248 wrote to memory of 3964	2248	csrss.exe	117
PID 4320 wrote to memory of 2504	4320	csrss.exe	119
PID 2860 wrote to memory of 576	2860	csrss.exe	121
PID 3212 wrote to memory of 2696	3212	csrss.exe	124
PID 2860 wrote to memory of 1252	2860	csrss.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
"C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1836
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:5008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:576
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1252
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4848

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 fe00b838716a0c2c6f0d38adc76f6c2025493c6e2e981745448bc7785abc5e3d
MD5 cd9b79ff041e4404b6482e1a99add886
SHA1 e4a0c7ba8999ac8610f5358f713878545f42ec8f
SHA512 d01d5e490fca129c393ca01d0095496b0c171bce8ea7b3de5979d5d257bc019cbc7a0961df940bd3bff50f3c5dfd6ce78601847d09c47ceb9fe3bb8d97253fb6
SSDEEP 384:5L3HhwpSS1xX7QfqElIHnnNvjQGIsLj5TsUjKayEIDXiJILOj9xFy:BxQSSkvqNvjfIsL9TxKx9DXiOLWA
TLSH
T1C792D59E711F16C3C88563B8D10A040FE8F2DE8D031956DDBB2E8F7B89AC99A417D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 27647e5e982ac37756e2052020f678b2d3ac4ae229d237c0ffaf89cb9146e842
MD5 3e8b89063d31ded9f3051c2ce7e2d5c8
SHA1 2b1e78809738b2542f63ef708c721926973459a4
SHA512 8f0da36b310d1b6227442377cedbe101a79040a392172c0ed3a7c0d6e1da2cd22d3cf2dcff74a9717f84f4bc680305228e8c789cc6dd4f8311a08aa5bdf7f079
SSDEEP 384:LL3Hhwz1SSpAHvtiaxwERBgU8HnQaK2IG5Vdq4GexyhaWxLSnY9phAUd5H:/xISSCPUWJRToQaBP5Vw8CaWl99p2UT
TLSH
T161923A59621F2ADBC49923F8C427039FDAB58EDE43005BCEB39D583B05CA66144BD9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_q44ynldb.awk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q44ynldb.awk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5e7998963b0599cf73a17c411e04ab91a7bcb11acb3f75effccd77d8cc9db3f4
MD5 48006830e7315cc0e7b3a2d060adf31b
SHA1 25c4b3fab0bcb695392d65df8586304ff9a2d1c0
SHA512 a6b0edae789de365376c32021944c57676cd5282346b7488100449ddc3ff73d07d0219e2facbb2c60a95ebeb9125899a43a6df2f34e9def37e6117e3c7fdba4c
SSDEEP 384:EL3HhpWStVeU8EWnQeaXN7jWa1ICOLNXjGbo7SzynY9jhUdkH:qfWSyUu+7jWa1ICOLNzG0Wzd9lU0
TLSH
T1A79228AD225F26DBC89513F8C426079FE9B09EDE030053DDA71A6D3B05DE27280AD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5ffc0b60223a26cb74eb03cb584bbb121eff8073c38e96bd964aa428a21dcf42
MD5 c74102478ad7676f94a2b74363c5bebe
SHA1 d81dc8272fec78277426d89d9b59f81df64c74de
SHA512 fff011059a837e8efe61529e9815b171f54364e97db506d9df7c783e56cbe0f6ced5077486c8607610a03eb205b022d86729afd282af309b4b6c3af03174113d
SSDEEP 384:YL3HhXVmSttfAYPq6FRHEME8tATUNvjWaK2KLNXjg14bf0IiiSnY9jhUdMH:+xVmS79S6RPEtTqvjWaBKLNzgubjii9x
TLSH
T17892396D226F26D7C4E523F8C02607DFEEB09DDE430453DEA2599D3B02CA67584984ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 7e10dfce4bb20b5edea8a5b2bdf7e0ed34debcd5ddd26782450bb3ac64168f95
MD5 92e75415f0280fa43b1506548550dd92
SHA1 2755df2194619f2ca4d2cd11d9bcc1855667374a
SHA512 3dfe9e27c07deea31b3b347d2a7561946a9798776309ea580e9662e0243434d674f153edea9419cd4fcc6a6114dfdb9092ccb2bb76c0a5d4f6178569c9452464
SSDEEP 384:aL3Hhz1S2kTU4LFRHEMEpMiX1HnfCa1k2jCLNej/4bbfSzQSanY9jhUdUH:kvS3BpRPEpVX5fCa13uLNLbWzQO9lUo
TLSH
T16792289D326F329BC4A913F9C026078FE8B09EDF030457DE6619683B04CE67194695ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 07990fa69309f81d6eee31100c0244f898b01518b3db68ad49c9c77336902e5d
MD5 57e341f6e90be54612da070dc334b796
SHA1 2812aeae066062eafdc04d2a28ef02f28cfc1ded
SHA512 75ca43633615c603179ddc8737a691b97c91922673ad00f1421e91290d96d4c9da5c3e280de4162c1f1db5d33fd74cc0426312dd799595e40f8d9d11da10e51c
SSDEEP 384:NTHhdSpLBy14Am2ii8Y/t3UFQpUM22QNgUKzEcE7lqi2e6TkSu60Aah:1ABy1TEAUFQpUM22PSciH6Teb
TLSH
T132920872569D3BB6EE0FC7AF4AE2276D8E1423F647A0E0FA0330614604C7667FC49595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 0d4ebde29e89323ed7b7fa430bc0b35c3f8cf8867ceb8374722247718a379dec
MD5 d24744d69ac7821936ec54448982a71c
SHA1 73b4a7355870edbd0be0d8512d3361c6a9962c66
SHA512 332b3bab6c97f298aee09849c066816dbae0d9fe9e946f41fd50fd820e59c5eacc4a09c553fae0cad2fc2e6b73f3aedf00d45c32207bcbd8aab728cde3e18130
SSDEEP 384:fTHhwj2kjqKiuOPGaWwUj/gHnnNjc2OLNfV+bIMz/nY9jhUdtH:ej3MuOTW5b8NjvOLNt+bnzA9lUf
TLSH
T1E5923A59226F268BC4A913B8C022039FFDF08EDF434417DE9329983B05CF67690A95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c4e9eb63563edd7fca26e25c9db34969980af9ed36c664b0588d66226b75b563
MD5 b0220bbe82fe3536fadb395f3cee32ba
SHA1 1907d86cd12feb746a5ecb50f41ccfdab5b69b09
SHA512 3fbb560935dff7b30a9178a944b6fd9a858618868fe804801bde3ff6d526c7c45df3cc10be224b03a42172130564722aaf67b4157ce1c9d691915d213df6ed61
SSDEEP 384:KL3Hhv/iSJObiRcAz7ZSnvHcnNvjQGIrs+NXjg2lZbbzzzIRjNndF+:U5iStmAz7wCvjfIrs+NzgeZbb/zI3dk
TLSH
T1FD92C5AE711F12C3C88663B8D10A010FE8F2DE8D031A52D9BB2E9E7B89AC55E413D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 00008addf0d640a9a921c903f5d4182c612aa0750efc04b88774b582f567b77b
MD5 c47d82ed08e3f64807143de07dfa197a
SHA1 8be28ceccb195a4b1494a02e7df68c7221c2c90d
SHA512 2b55856be0be2a5a5acd904dd01568b01eb37f21600f98184691b687c8a7fd7e5487b303647353e9d4112e57cfc9da72eb9dc499ec2b6f84ba79b3464bb0912d
SSDEEP 384:aTHhwiStI7zb8JFRHEMEI2j1xmCa1KLNeogt/Hbvfaz/nY9jhUd9H:diSCHb8HRPEI2yCa1KLNLMbazA9lUr
TLSH
T1AA92296D226F26E7C4A613F8C022039FE9F09ECF830413DE63595E3B06CA67584695ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-71-0x0000000005A30000-0x0000000005D87000-memory.dmp

Download

memory/232-74-0x0000000070DB0000-0x0000000071107000-memory.dmp

Download

memory/232-73-0x0000000070C30000-0x0000000070C7C000-memory.dmp

Download

memory/576-201-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/576-202-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/2504-190-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/2504-191-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/2696-216-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/2696-217-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/2836-28-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/2836-31-0x0000000007390000-0x0000000007434000-memory.dmp

Download

memory/2836-35-0x0000000007600000-0x0000000007696000-memory.dmp

Download

memory/2836-36-0x0000000007520000-0x0000000007531000-memory.dmp

Download

memory/2836-37-0x0000000007560000-0x000000000756E000-memory.dmp

Download

memory/2836-38-0x0000000007570000-0x0000000007585000-memory.dmp

Download

memory/2836-39-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/2836-40-0x00000000075E0000-0x00000000075E8000-memory.dmp

Download

memory/2836-1-0x0000000002A30000-0x0000000002A66000-memory.dmp

Download

memory/2836-2-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/2836-3-0x00000000051B0000-0x00000000057DA000-memory.dmp

Download

memory/2836-4-0x0000000005060000-0x0000000005082000-memory.dmp

Download

memory/2836-5-0x0000000005100000-0x0000000005166000-memory.dmp

Download

memory/2836-6-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/2836-13-0x0000000005B10000-0x0000000005E67000-memory.dmp

Download

memory/2836-32-0x0000000007B00000-0x000000000817A000-memory.dmp

Download

memory/2836-33-0x00000000074B0000-0x00000000074CA000-memory.dmp

Download

memory/2836-27-0x0000000007370000-0x000000000738E000-memory.dmp

Download

memory/2836-0-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/2836-18-0x0000000007330000-0x0000000007364000-memory.dmp

Download

memory/2836-14-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Download

memory/2836-29-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/2836-15-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Download

memory/2836-16-0x0000000006300000-0x0000000006346000-memory.dmp

Download

memory/2836-30-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/2836-20-0x0000000070CA0000-0x0000000070FF7000-memory.dmp

Download

memory/2836-19-0x0000000070B20000-0x0000000070B6C000-memory.dmp

Download

memory/2836-34-0x00000000074F0000-0x00000000074FA000-memory.dmp

Download

memory/2836-17-0x000000007F9B0000-0x000000007F9C0000-memory.dmp

Download

memory/3964-176-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/3964-175-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/3984-168-0x0000000005D80000-0x0000000005D95000-memory.dmp

Download

memory/3984-151-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/3984-152-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/4556-133-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/4556-134-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/4556-141-0x00000000075F0000-0x0000000007601000-memory.dmp

Download

memory/4556-148-0x0000000005980000-0x0000000005995000-memory.dmp

Download

memory/4648-111-0x0000000006600000-0x000000000664C000-memory.dmp

Download

memory/4648-131-0x0000000005F70000-0x0000000005F85000-memory.dmp

Download

memory/4648-130-0x0000000007760000-0x0000000007771000-memory.dmp

Download

memory/4648-122-0x0000000007410000-0x00000000074B4000-memory.dmp

Download

memory/4648-114-0x00000000714D0000-0x0000000071827000-memory.dmp

Download

memory/4648-113-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/4648-109-0x0000000005BD0000-0x0000000005F27000-memory.dmp

Download

memory/4896-91-0x0000000070E30000-0x0000000071187000-memory.dmp

Download

memory/4896-90-0x0000000070C30000-0x0000000070C7C000-memory.dmp

Download

memory/4896-88-0x0000000005850000-0x0000000005BA7000-memory.dmp

Download

memory/5012-61-0x00000000078F0000-0x0000000007905000-memory.dmp

Download

memory/5012-60-0x00000000078A0000-0x00000000078B1000-memory.dmp

Download

memory/5012-59-0x0000000007560000-0x0000000007604000-memory.dmp

Download

memory/5012-51-0x0000000070C30000-0x0000000070C7C000-memory.dmp

Download

memory/5012-52-0x0000000070E70000-0x00000000711C7000-memory.dmp

Download

memory/5012-50-0x00000000063A0000-0x00000000063EC000-memory.dmp

Download

memory/5012-49-0x0000000005E00000-0x0000000006157000-memory.dmp

Download