glupteba | 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmptixbqev1.exe
Size 9.1MB
Sample260602-l2vwvaby6l
SHA256 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38
MD5 bc0aad16afd950734d50b5de1fe9719e
SHA1 6f1041e4d8c3c6f674d97005e34fbae7d8ade2ba
SHA512 bcea310c2c42fdf23df463db5e8d83ff543a3c3726ee4b64093c57e50a01919032c26124d531b5b4694129b87e5b33747842ff38172ad0e87956f6e2db73dede
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf8hZytTD5iq5:sxEvYjVzAN0hwN
TLSH
T14EA66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000024307-106.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2580	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4600	csrss.exe
3372	csrss.exe
4028	csrss.exe
2964	csrss.exe
3044	csrss.exe
5076	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmptixbqev1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmptixbqev1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmptixbqev1.exe
File created	C:\Windows\rss\csrss.exe	tmptixbqev1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1500	powershell.exe
3648	powershell.exe
1384	powershell.exe
2848	powershell.exe
4588	powershell.exe
4192	powershell.exe
1224	powershell.exe
5072	powershell.exe
3396	powershell.exe
1432	powershell.exe
4976	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmptixbqev1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmptixbqev1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
312	schtasks.exe
4092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3396	powershell.exe
3396	powershell.exe
4724	tmptixbqev1.exe
4724	tmptixbqev1.exe
1500	powershell.exe
1500	powershell.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3012	tmptixbqev1.exe
3648	powershell.exe
3648	powershell.exe
1384	powershell.exe
1384	powershell.exe
2848	powershell.exe
2848	powershell.exe
4588	powershell.exe
4588	powershell.exe
3372	csrss.exe
3372	csrss.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
1224	powershell.exe
1224	powershell.exe
1432	powershell.exe
1432	powershell.exe
1224	powershell.exe
1432	powershell.exe
5072	powershell.exe
5072	powershell.exe
5072	powershell.exe
2964	csrss.exe
2964	csrss.exe
4976	powershell.exe
4976	powershell.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
4600	csrss.exe
4600	csrss.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
4600	csrss.exe
4600	csrss.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe
5076	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	4724	tmptixbqev1.exe
Token: SeImpersonatePrivilege	4724	tmptixbqev1.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	3372	csrss.exe
Token: SeImpersonatePrivilege	3372	csrss.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	2964	csrss.exe
Token: SeImpersonatePrivilege	2964	csrss.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3396	4724	tmptixbqev1.exe	84
PID 3012 wrote to memory of 1500	3012	tmptixbqev1.exe	91
PID 3012 wrote to memory of 3804	3012	tmptixbqev1.exe	96
PID 3804 wrote to memory of 2580	3804	cmd.exe	98
PID 3012 wrote to memory of 3648	3012	tmptixbqev1.exe	99
PID 3012 wrote to memory of 1384	3012	tmptixbqev1.exe	101
PID 3012 wrote to memory of 4600	3012	tmptixbqev1.exe	103
PID 4600 wrote to memory of 2848	4600	csrss.exe	104
PID 3372 wrote to memory of 4588	3372	csrss.exe	108
PID 4600 wrote to memory of 4192	4600	csrss.exe	120
PID 4028 wrote to memory of 1224	4028	csrss.exe	125
PID 2964 wrote to memory of 1432	2964	csrss.exe	127
PID 4600 wrote to memory of 5072	4600	csrss.exe	129
PID 3044 wrote to memory of 4976	3044	csrss.exe	132
PID 4600 wrote to memory of 5076	4600	csrss.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe
"C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe
  "C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2848
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:312
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5076
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4092

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1224

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 7949728962b076b9e2646a5a77da3ee3d89d57beb6e1948b50671361d81de682
MD5 61faa78bafbd0c8d3274953e7ec1aeef
SHA1 e0e383153465a46e04e66981e1f93383363f3d0c
SHA512 1076215992d9b91f2cf952c56866efd73eeca33c81f97fc5884ff2b52fb52d9308b531e049e9eac1ea98d5dbd2fdac131c2034f45cecc2cfba58675e140493f5
SSDEEP 384:3sf+hol9i+ZeCUd4BBicIwk7o9o2T9K6seYbneKx/xoXLYbLU0SF5Lt9KuA/9JfH:cfAHC3ocoso2T9N+nVAY/XYLt9OXOK0M
TLSH
T16DA2D65E618F1AC3C4861378D10A041FE8F29D8D43191AD8BB1F8F7B8AAC6BF6139548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 89fc95b02a5f7b919e68311435cee348981647597c8b72fb0ac4eae80211e3f5
MD5 70ec9ab06141102a8c87b784229bef6c
SHA1 a24326ba7dd44f65059d8702a9e4a47e781ce532
SHA512 4a4323f03ae7001699e8c2f7d130f8ff7c92056676c8d66f69a0db15a8ee97d8ef3c33405c74fb48344cab86aaf5d02395369ba735fc0a0fbf00c54be77e5443
SSDEEP 384:j6+ho99bpk5Qu5nzJk+orNYFFNpfemTP/p39cFnsXcSoUIrLk5k1LWKucN/3xrJo:2A8cz5eRN8FNpflPUFsaU0LoqKOd8CLu
TLSH
T145A2395E621F2A97E56923B8C426479FE0F09CCFC3005ACCA74A5A3716CB67564F81F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_q0wvjgx0.k1z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0wvjgx0.k1z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b5c0134d8f4cac5b98793b259f1305ca71dd62c0a64d3028b16d8c0aee21004d
MD5 57176ee66b0198095ced94413419fc5e
SHA1 edcf622c9a59706fed1ba44bc1db959d2040b181
SHA512 7573fb53f99bfb5d23696a0c81e8343d9d4e353c18a0f398896d8baedf27b068a84d3b61f93b40184541a2d5ee9de52a7b6e7297501a827a969eb28123825e06
SSDEEP 384:8sf+BS9RBQK4muG4kwo9o5ATpNYFFNpfNdc7/IOq01J21RGA+nFbOuj3lu3JOg:5fNQ7FGTFo5ATpN8FNpf47lw1RE4ublQ
TLSH
T19992195E621F2AD7C0A613F4D426439FD4B08DCF830107DD668A6E3B06CAA7594AC5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 771854b95eefdf7028f42dc716904a42b000bbf111cb629d1180603a202538d6
MD5 3d83c81cba8dd64d7962a6af493c7166
SHA1 611ec32e7326f3f3435c0f5f0e163f409a996a8a
SHA512 f6926834d40b4eac96b7fcb9aff37d0bbf0e85b0b61e1b7d3eb2076d6f2c8133054cec94be0e32362d823d2a78f48208673163ac662ec358f549a9ba9e74a586
SSDEEP 384:orsf+BpRBMw5VnBizMkMaS5NYFFNpfUywTv/ZJwPM9dh1EY+nFbOuj3lkY2Og:owfaMw7o7MaS5N8FNpfITvqsn1S4ublQ
TLSH
T13A92195D610F2AD7D4A623B4C02747EFE9F09DCFC30487DD274A192706DB7A584A91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ff50097709ccc48eac2db25e3de915d27b738cfa0a1989255eedbf78f465c485
MD5 72f6602f61b095bca2a3334bcc4c91b9
SHA1 54129689aa083306e30c4001aec6b5d5f21faac1
SHA512 f9ad5dec91654057bac65759e37d286e78be624ed74cd44056020077e0812db180a75dc9e6ba9a8e6d06edfbfba9f1ae67732d7808d18a715eb65e1a3fe840b3
SSDEEP 384:286+BnRB05iwI3REPTto9o2RKeYFTpfev/IOMcmXlDc1zq+nFbOuj3lgOg:29U0j6o2RN8TpfcFmo1z4ublw
TLSH
T1B692285D221F2A96E12613F8E03647EBF9B0ADCFC30007DD56961E3706DA676C4A81F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1db2994d561f9923b6d6d51150fbb9f865b4b510333a8be99090259a93ea1c79
MD5 d8c80601c5d22828e3f83d37f7c6ba27
SHA1 317ae9cf8f7d44b5a8f2fa8f4178f276540b435e
SHA512 5d583031dd9254dd8456c193594508c93a4a93e271584b9f903f21c4ce7b5aacf45731ce9ee2d59633515b235aa94f8c20974c076f0efb015dffcba85175e7c8
SSDEEP 384:u6+BHRBdyRO0FVVnZzJkMto9o2RKeYFTpfNWUOMck+1Ytood1RjaR+nFbOuj3lus:r0IPVZeBo2RN8Tpf8xVUP1R54ublT
TLSH
T1A7920759222F3A57C46913F8E43A47EBE930ADCF93440BDD26861D3706CA675C8B91F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 255c3982462370a92094e338fb547e6b6ccc09136afcd5578901a8eb02963972
MD5 6d5ec455a2645e0ec0972f0684a4094b
SHA1 70699736f9059b0da936d1de9ffbd4a96047ede4
SHA512 ef69c3ea37d69ebbd1ea0f9f1b90ac40bebb986ba8dee6052034ba21a19f0e38f64411cb74be418db0c55a91b6907c9389f50178f9ede37bef848788c9ae1250
SSDEEP 384:y6+BnRBKfrCzf9YPMPBUTtRjB8NYFFNpfemxw7/IOiaMhdM81Ex+nFbOuj3lusOg:fUKfQVYPeqRjB8N8FNpfQ7vYL1z4ublj
TLSH
T18792175E621F2AD7D4A112B4C42A47DFE9F09ECFC38407DD57482A3B06CE76690E91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 373406e03e861ad4c50f79e870c94a11d1eedd0b6c831209d6e455c7761154c0
MD5 313e387975a97662b938ee280e102aac
SHA1 3cf12cd6c7e0a356bbc4863b92115646662dbb73
SHA512 8c9de7a5e46707c640c8438cb585697a9588958c865a2e8a08c1aa3754b00f859bf5e2716b278ea2c52b04ec91ebd470f3472d5f366a0dac0d62549c78f580b7
SSDEEP 384:D6+B19m+6x/wizJkz0xRyblz9K6seYbne28v/ZJwM0hO+EIjaiFqZbObTUSyR:WXnezwRglz9N+ncvgO+EIV4qMVR
TLSH
T19F92D75D211F16C3C48613B8E117055FE8F2EE8D531A13D9BB2E9F3B4AACA9E913C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 95b510fc81fdadf4c9cd88f5f63fec5ceb4da839fffe3c5d84bfc41a7d700dc6
MD5 0b57152da05061de7440b6fda469975f
SHA1 62d6c03502983867677b1d503e647b40b36d31e8
SHA512 24387efd024b4525ddb3405bc3aed4b90fc01aae6b50acc94786a2986ac591dd0120d00b531b7a0e04225a5d35c15809d3a2aeecc228a25a3bcb6f5ccb982710
SSDEEP 384:W8sf+BnRBUBnZJdUJk+o9o5o0NYFFjffemxc7/Zi0hdm1RG8+nFbOuj3lutvOg:W5fUUBRVjo5o0N8Fjff87hc1Rg4ubl8
TLSH
T10A92295E620F2A93C05513F8E42A47DFE4B09ECF830007DD5A865E3B06CA77A94BC1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38
MD5 bc0aad16afd950734d50b5de1fe9719e
SHA1 6f1041e4d8c3c6f674d97005e34fbae7d8ade2ba
SHA512 bcea310c2c42fdf23df463db5e8d83ff543a3c3726ee4b64093c57e50a01919032c26124d531b5b4694129b87e5b33747842ff38172ad0e87956f6e2db73dede
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf8hZytTD5iq5:sxEvYjVzAN0hwN
TLSH
T14EA66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-201-0x0000000007B30000-0x0000000007BD3000-memory.dmp

Download

memory/1224-193-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/1224-192-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/1224-218-0x0000000006680000-0x0000000006691000-memory.dmp

Download

memory/1224-220-0x00000000066D0000-0x00000000066E4000-memory.dmp

Download

memory/1384-94-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/1384-95-0x0000000070DF0000-0x0000000071144000-memory.dmp

Download

memory/1432-202-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/1432-203-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/1500-53-0x0000000070DF0000-0x0000000071144000-memory.dmp

Download

memory/1500-62-0x0000000007F00000-0x0000000007F11000-memory.dmp

Download

memory/1500-63-0x0000000007F50000-0x0000000007F64000-memory.dmp

Download

memory/1500-61-0x0000000007BF0000-0x0000000007C93000-memory.dmp

Download

memory/1500-52-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/1500-50-0x0000000006350000-0x00000000066A4000-memory.dmp

Download

memory/1500-51-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Download

memory/2848-138-0x0000000005F40000-0x0000000005F51000-memory.dmp

Download

memory/2848-117-0x00000000066F0000-0x000000000673C000-memory.dmp

Download

memory/2848-129-0x0000000070D50000-0x00000000710A4000-memory.dmp

Download

memory/2848-115-0x0000000005AB0000-0x0000000005E04000-memory.dmp

Download

memory/2848-137-0x00000000073E0000-0x0000000007483000-memory.dmp

Download

memory/2848-148-0x0000000005F80000-0x0000000005F94000-memory.dmp

Download

memory/2848-128-0x00000000705C0000-0x000000007060C000-memory.dmp

Download

memory/3396-33-0x0000000007FA0000-0x0000000008043000-memory.dmp

Download

memory/3396-11-0x00000000062A0000-0x00000000065F4000-memory.dmp

Download

memory/3396-1-0x0000000005410000-0x0000000005446000-memory.dmp

Download

memory/3396-2-0x0000000005C00000-0x0000000006228000-memory.dmp

Download

memory/3396-40-0x0000000008130000-0x0000000008138000-memory.dmp

Download

memory/3396-39-0x0000000008140000-0x000000000815A000-memory.dmp

Download

memory/3396-38-0x0000000008100000-0x0000000008114000-memory.dmp

Download

memory/3396-37-0x00000000080E0000-0x00000000080EE000-memory.dmp

Download

memory/3396-36-0x00000000080A0000-0x00000000080B1000-memory.dmp

Download

memory/3396-35-0x00000000081A0000-0x0000000008236000-memory.dmp

Download

memory/3396-34-0x0000000008090000-0x000000000809A000-memory.dmp

Download

memory/3396-0-0x00000000055C0000-0x00000000055D0000-memory.dmp

Download

memory/3396-24-0x00000000055C0000-0x00000000055D0000-memory.dmp

Download

memory/3396-32-0x0000000007F80000-0x0000000007F9E000-memory.dmp

Download

memory/3396-23-0x0000000070D00000-0x0000000071054000-memory.dmp

Download

memory/3396-22-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/3396-3-0x00000000058F0000-0x0000000005912000-memory.dmp

Download

memory/3396-4-0x0000000006230000-0x0000000006296000-memory.dmp

Download

memory/3396-21-0x0000000007F40000-0x0000000007F72000-memory.dmp

Download

memory/3396-5-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/3396-14-0x00000000069C0000-0x00000000069DE000-memory.dmp

Download

memory/3396-20-0x000000007F080000-0x000000007F090000-memory.dmp

Download

memory/3396-15-0x0000000006FC0000-0x000000000700C000-memory.dmp

Download

memory/3396-16-0x0000000006D80000-0x0000000006DC4000-memory.dmp

Download

memory/3396-17-0x0000000007D60000-0x0000000007DD6000-memory.dmp

Download

memory/3396-18-0x0000000008460000-0x0000000008ADA000-memory.dmp

Download

memory/3396-19-0x0000000007D00000-0x0000000007D1A000-memory.dmp

Download

memory/3648-74-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/3648-76-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/3648-77-0x0000000070DB0000-0x0000000071104000-memory.dmp

Download

memory/4192-190-0x0000000006180000-0x0000000006194000-memory.dmp

Download

memory/4192-164-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/4192-173-0x00000000075C0000-0x0000000007663000-memory.dmp

Download

memory/4192-165-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/4192-162-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/4192-160-0x0000000005D00000-0x0000000006054000-memory.dmp

Download

memory/4192-189-0x00000000078E0000-0x00000000078F1000-memory.dmp

Download

memory/4588-150-0x0000000005DB0000-0x0000000005DC4000-memory.dmp

Download

memory/4588-139-0x00000000705C0000-0x000000007060C000-memory.dmp

Download

memory/4588-140-0x0000000070D50000-0x00000000710A4000-memory.dmp

Download

memory/4976-242-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/4976-243-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/4976-251-0x0000000006D20000-0x0000000006DC3000-memory.dmp

Download

memory/5072-225-0x0000000070770000-0x0000000070AC4000-memory.dmp

Download

memory/5072-224-0x00000000704D0000-0x000000007051C000-memory.dmp

Download