glupteba | 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38

Analysis

max time kernel
150s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmptixbqev1.exe
Size 9.1MB
Sample260602-l2vwvaby6l
SHA256 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38
MD5 bc0aad16afd950734d50b5de1fe9719e
SHA1 6f1041e4d8c3c6f674d97005e34fbae7d8ade2ba
SHA512 bcea310c2c42fdf23df463db5e8d83ff543a3c3726ee4b64093c57e50a01919032c26124d531b5b4694129b87e5b33747842ff38172ad0e87956f6e2db73dede
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf8hZytTD5iq5:sxEvYjVzAN0hwN
TLSH
T14EA66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001400000002b3be-101.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1560	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4512	csrss.exe
1480	csrss.exe
1608	csrss.exe
4900	csrss.exe
4520	csrss.exe
1692	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmptixbqev1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmptixbqev1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmptixbqev1.exe
File created	C:\Windows\rss\csrss.exe	tmptixbqev1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3064	powershell.exe
2152	powershell.exe
3340	powershell.exe
4644	powershell.exe
2672	powershell.exe
2644	powershell.exe
1428	powershell.exe
4288	powershell.exe
240	powershell.exe
1424	powershell.exe
4056	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmptixbqev1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmptixbqev1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
416	schtasks.exe
3484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe
2456	tmptixbqev1.exe
2456	tmptixbqev1.exe
4056	powershell.exe
4056	powershell.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
4760	tmptixbqev1.exe
2644	powershell.exe
2644	powershell.exe
1428	powershell.exe
1428	powershell.exe
3064	powershell.exe
3064	powershell.exe
4288	powershell.exe
4288	powershell.exe
2152	powershell.exe
2152	powershell.exe
1480	csrss.exe
1480	csrss.exe
3340	powershell.exe
240	powershell.exe
3340	powershell.exe
240	powershell.exe
1424	powershell.exe
1424	powershell.exe
4900	csrss.exe
4900	csrss.exe
4644	powershell.exe
4644	powershell.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
4512	csrss.exe
4512	csrss.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
4512	csrss.exe
4512	csrss.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe
1692	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2456	tmptixbqev1.exe
Token: SeImpersonatePrivilege	2456	tmptixbqev1.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	1480	csrss.exe
Token: SeImpersonatePrivilege	1480	csrss.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	4900	csrss.exe
Token: SeImpersonatePrivilege	4900	csrss.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeSystemEnvironmentPrivilege	4512	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2672	2456	tmptixbqev1.exe	80
PID 4760 wrote to memory of 4056	4760	tmptixbqev1.exe	85
PID 4760 wrote to memory of 404	4760	tmptixbqev1.exe	87
PID 404 wrote to memory of 1560	404	cmd.exe	89
PID 4760 wrote to memory of 2644	4760	tmptixbqev1.exe	90
PID 4760 wrote to memory of 1428	4760	tmptixbqev1.exe	92
PID 4760 wrote to memory of 4512	4760	tmptixbqev1.exe	94
PID 4512 wrote to memory of 3064	4512	csrss.exe	97
PID 1480 wrote to memory of 4288	1480	csrss.exe	99
PID 4512 wrote to memory of 2152	4512	csrss.exe	105
PID 1608 wrote to memory of 3340	1608	csrss.exe	116
PID 4900 wrote to memory of 240	4900	csrss.exe	118
PID 4512 wrote to memory of 1424	4512	csrss.exe	120
PID 4520 wrote to memory of 4644	4520	csrss.exe	123
PID 4512 wrote to memory of 1692	4512	csrss.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe
"C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe
  "C:\Users\Admin\AppData\Local\Temp\tmptixbqev1.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3064
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:416
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1692
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3484

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:240
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 ea3b40d126d20ac17eec0a5aa2e7f422af7291411cda24f319d93c5a1040635e
MD5 395baae72d3f99f0496d8647e237612c
SHA1 2768e10943450f14fce816ac03519c8b96a2a1a6
SHA512 5d00c825f4a16bb94b7323286578c4d9d25ae92a40034179ff4c6a6e8440775a04ed957f859dd0a4129fc140b9b1b9b42ed2c832a7698edcf9b0dbdbb16b6e36
SSDEEP 384:zL3HhwzxSS1C/FFlxJUJjNnnN7jQGIZKLj5rsUjj4R6yEID7iJkLOj9VFy:nxESSAFr3UJ5N7jfIZKL9rxjqR9D7iCL
TLSH
T1E092E7AE711F16C3C88653B8D106000FE8F2DE8D031956DDBB2E9F7B89AC59E917D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 fb196bc03026a8d3969eb1e0b667ba0ab24df2125ee4862bbb68720f37678630
MD5 dca15e818cec9531320b7a4f850e017a
SHA1 5dec0af31049ced09ec4536bfcd89d2b2879f5ec
SHA512 fffae26ccef22b0ce0aaf2b39285f7d24937fb6d83d650dc4cd894816b11760e0068228f405d6c0065d94c48164e2c5cf4f242e311c436ff7a7aa22736ff9832
SSDEEP 384:dXTHhwz1SGAjX9Ty2W3FAwea4czhjWaK2ZL9meiMdqwGexyMYWxXnnY9phEUd5H:HISjjdMVAaTNjWaBZL959w0IWZY9pSUT
TLSH
T12B923B5D622F2A9BD8A923F8C426038FF5F08EDEC30057DE6319593B05CE66454B85EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_segk5zzr.gtg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_segk5zzr.gtg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 543d6e602c5e51475b9f7ca7c9c968f2396bb02db344c9310d297484afcb0f43
MD5 3b32134d6ffb3d2cc5e9ccb542096ac0
SHA1 492c34476cae1ce97a21ac14d058ba9a07ecd159
SHA512 b8b124fabfc30a72593b217b59466d9a0d1d4325e5910c43a795df52f9af9493e23a8ac5c98fc495849fc065708d0f5c9ae347c694b63861214a911e597241b4
SSDEEP 384:yL3HhwSStZrOSF8ZdeH4czNCa1IC4NXjC/4bPqzenY9jhUdxH:8KSSrf8iT5Ca1IC4NzvbyzB9lU/
TLSH
T1CC92296D226F2697E4A513F4C012439FF8F08ACFC34096DE67596D3B05CF26584A85ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 972378dccbff5556d42fdb6857875a244936740f2aba9cc9b9b62f885dab3499
MD5 ab4d97dbc17fd78c783bd98ddfdb579f
SHA1 05e4602c59c2d05bd2ae01df6e3d299228843ad1
SHA512 e0336daa904ab24759fc28a89c0ec3331cae20b288b6c3dae314d02a8701676f0c85db9cf77b7616313d7e81f9cebda5c5a63a5c354ade3f131b4dee78cd6dfb
SSDEEP 384:wTHhz1SStknfEdFRy2RHO+HHtOa13OLNbjg1/HGdMz/nY9jhUd9H:aSS2ns7RyOHNOa13OLNXgxzzA9lUr
TLSH
T16D92396D326F2697C4A623F49026079BFDF05ECF838413DE675A583B05CA67284A91FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 df0ff16831aa256b7df81a96e1174c11778f5d2be9e5359bfdef75caf304c6bb
MD5 02b9e9294a91f566a686459864329b44
SHA1 746494040320fa5a65825f72740ebc0152a87a56
SHA512 262f548e66c32e0bbdf545529fe3d90bd1acba580fde5b6a50fffaa9b038cd8eb4c9113c89f76c745a1bcebe27561b4ca90b484b1cb4f6277c2860631640d834
SSDEEP 384:uL3HhpmStb0tB2EwPHnhjF13eLNXkorfqzOnY9jhUdAH:4fmSiLfShjF13eLNPezx9lUQ
TLSH
T163922869322F269BD4A513F48027079BFDF09ECFC34416DE531A5A3B06CB2B180A94ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 42f398d7feeccb59f3c128a7a1b7c0aade7d3de024a5ddfcdf0e50be4b4ef7cd
MD5 0ca242a05a6be5d994118bef7041e70a
SHA1 43842c10e7653df46097d3e95be27099db738bba
SHA512 75879f5d7ddec68184dd355bda7bfb67df3a26c12d45991a3ef3bacb4bf1e951790caad32dbb37dd4fba14be4ed31a29b3a8f5843739cd0fb0a584325bbadf4d
SSDEEP 384:LTHhz1S2kjOrQb3AKuFReya6oTedWcz8aK2Akz/mE08zbnY9jhUdkH:PS3NwK+RePBGQaBAAzE9lU0
TLSH
T141921859222F269BF97623F880321BCBF9A08DDFC30092DE1745583A05CB67094E96FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ab3857212322fe6a377d6302e800c5bd406abe6f93b33728112ccf57cb99241b
MD5 db38a6a638ba0e2ac2480d1d8e1a79fc
SHA1 67a934408fffb3d66e063d896aa29a848fe9cb3d
SHA512 2b9ce1ad6d4a29ab567bcf3ec2522b47201b013fa0ac701d3671e44c8e58ccb2e700d9f5f0c0f4be6b8d6df0bc232e35b6476b4dc80a7405abc284bf624502b4
SSDEEP 384:2L3HhwjStkjcIcOmrFRHE9EOceTczSk9jfk2eLNXW/4br0sbynY9jhUdkH:gKjS24UgRyE9h9jf3eLNjbTbd9lU0
TLSH
T15D92295D726F228BE8A513F8C4260B87F9B08DDFC30456DE9716A83B05CB27084A95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 91fad653de7ce63e7a6e261c3cb3fb9469f26f786ed1b19ad7c9bb346236b9fd
MD5 192530414f777530f35f753ad9998b65
SHA1 3f54a16d1767e2e1cb59dfd80e53ddba96f475f7
SHA512 9e2bfe1de7872c6bb4e9fe313e7308ff6e0ee10b83f28e9f50f029b811f6efd24322a0a9dc9d856953d88085357eeac987a1ff2b00dea7429146912b63e66bae
SSDEEP 384:KTHhRSSJQjaiBSGh54UEMEEpnnNvjQGIrs+NXjg2l+bbzzzFRjNndF+:ESSqhZ+sEqNvjfIrs+Nzge+bb/zF3dk
TLSH
T1C292E6AE715F22C3C89553B8E10B040FE8F2DE8D031A52D9BB2E9F3B89AC55E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b05ebd73e202540c409255d1cd86d46c612b4b8062867040bfdc70ff61b9e890
MD5 526d78db9f795beb3283ba28d692bcb9
SHA1 b6649ccebb40c6f19807b106813491b83b877846
SHA512 c860087b0d6738dee404ec7944d7ba593151db80a4b61293c45f6f1fa93608f2251930d848728e2cd4a56f61f2be2e3b0fe68df60ebddf1c099cf4614aa26e39
SSDEEP 384:FL3HhpSStMKjRnhto+RHdEf4H/znNjF1+LNX8xqk4b7fPuzynY9jhUdsH:9vSSTRnhtvR9EfE/pjF1+LNXzbqzd9l5
TLSH
T18F923969322F2697D4A513F8D012078FFCF0AECE830413DE665A5E3B06CA675C4A85ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 98577c1cc4f73ba7af6cb130b593d3b984ee019779aae5cad3e867cb490ada38
MD5 bc0aad16afd950734d50b5de1fe9719e
SHA1 6f1041e4d8c3c6f674d97005e34fbae7d8ade2ba
SHA512 bcea310c2c42fdf23df463db5e8d83ff543a3c3726ee4b64093c57e50a01919032c26124d531b5b4694129b87e5b33747842ff38172ad0e87956f6e2db73dede
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf8hZytTD5iq5:sxEvYjVzAN0hwN
TLSH
T14EA66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-182-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/240-183-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/1424-201-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/1424-202-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/1424-209-0x00000000078E0000-0x0000000007984000-memory.dmp

Download

memory/1424-216-0x0000000007C50000-0x0000000007C61000-memory.dmp

Download

memory/1424-218-0x00000000060C0000-0x00000000060D5000-memory.dmp

Download

memory/1428-91-0x0000000070F70000-0x00000000712C7000-memory.dmp

Download

memory/1428-90-0x0000000070D20000-0x0000000070D6C000-memory.dmp

Download

memory/1428-88-0x00000000055C0000-0x0000000005917000-memory.dmp

Download

memory/2152-153-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/2152-152-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/2152-173-0x0000000005580000-0x0000000005595000-memory.dmp

Download

memory/2644-73-0x0000000070D20000-0x0000000070D6C000-memory.dmp

Download

memory/2644-71-0x00000000058E0000-0x0000000005C37000-memory.dmp

Download

memory/2644-74-0x0000000070EA0000-0x00000000711F7000-memory.dmp

Download

memory/2672-16-0x0000000006920000-0x0000000006966000-memory.dmp

Download

memory/2672-6-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Download

memory/2672-1-0x0000000004F00000-0x0000000004F36000-memory.dmp

Download

memory/2672-2-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2672-3-0x0000000005610000-0x0000000005C3A000-memory.dmp

Download

memory/2672-4-0x00000000054F0000-0x0000000005512000-memory.dmp

Download

memory/2672-5-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/2672-38-0x0000000007A30000-0x0000000007A45000-memory.dmp

Download

memory/2672-13-0x0000000005ED0000-0x0000000006227000-memory.dmp

Download

memory/2672-37-0x0000000007A20000-0x0000000007A2E000-memory.dmp

Download

memory/2672-0-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2672-40-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

Download

memory/2672-36-0x00000000079D0000-0x00000000079E1000-memory.dmp

Download

memory/2672-35-0x0000000007AC0000-0x0000000007B56000-memory.dmp

Download

memory/2672-34-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/2672-33-0x0000000007970000-0x000000000798A000-memory.dmp

Download

memory/2672-32-0x0000000007FB0000-0x000000000862A000-memory.dmp

Download

memory/2672-14-0x00000000063A0000-0x00000000063BE000-memory.dmp

Download

memory/2672-28-0x0000000007820000-0x000000000783E000-memory.dmp

Download

memory/2672-15-0x0000000006460000-0x00000000064AC000-memory.dmp

Download

memory/2672-27-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2672-31-0x0000000007840000-0x00000000078E4000-memory.dmp

Download

memory/2672-39-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/2672-17-0x000000007F710000-0x000000007F720000-memory.dmp

Download

memory/2672-18-0x00000000077C0000-0x00000000077F4000-memory.dmp

Download

memory/2672-19-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Download

memory/2672-20-0x0000000070D90000-0x00000000710E7000-memory.dmp

Download

memory/2672-30-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2672-29-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/3064-112-0x0000000006250000-0x000000000629C000-memory.dmp

Download

memory/3064-139-0x0000000005AB0000-0x0000000005AC5000-memory.dmp

Download

memory/3064-130-0x00000000076F0000-0x0000000007701000-memory.dmp

Download

memory/3064-122-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/3064-129-0x0000000007340000-0x00000000073E4000-memory.dmp

Download

memory/3064-121-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/3064-110-0x0000000005C10000-0x0000000005F67000-memory.dmp

Download

memory/3340-174-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/3340-175-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/4056-50-0x0000000005FD0000-0x000000000601C000-memory.dmp

Download

memory/4056-49-0x0000000005A70000-0x0000000005DC7000-memory.dmp

Download

memory/4056-61-0x0000000007520000-0x0000000007535000-memory.dmp

Download

memory/4056-60-0x00000000074D0000-0x00000000074E1000-memory.dmp

Download

memory/4056-59-0x00000000071A0000-0x0000000007244000-memory.dmp

Download

memory/4056-52-0x0000000070EC0000-0x0000000071217000-memory.dmp

Download

memory/4056-51-0x0000000070D20000-0x0000000070D6C000-memory.dmp

Download

memory/4288-141-0x0000000005610000-0x0000000005625000-memory.dmp

Download

memory/4288-131-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/4288-132-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download

memory/4644-219-0x0000000075440000-0x000000007548C000-memory.dmp

Download

memory/4644-220-0x0000000070C20000-0x0000000070F77000-memory.dmp

Download