glupteba | ce73f5d8a0d9382c0a1eee6acf7db89183ae009c5a472edcefa950ae2dfc063e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpbtunf0vk.exe
Size 9.1MB
Sample260602-l3vbpsax4w
SHA256 ce73f5d8a0d9382c0a1eee6acf7db89183ae009c5a472edcefa950ae2dfc063e
MD5 f848e5e94573f2d09e1aef116341070b
SHA1 358d266ee959110a044174d55e5c9e3ce60c6b58
SHA512 64b76777f5adcb4f4abde73bd99d98f251d96bde7fdbe51181271291ea9068b8822f5e0a0c84f39d999af30ed0ab5bd6f04220a827fbcac5c60e21f26d7c3a2e
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfchZytTD5iqz:sxEvYjVzANUhwN
TLSH
T1A7A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001700000002b05e-100.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
588	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4036	csrss.exe
1796	csrss.exe
3200	csrss.exe
1660	csrss.exe
1560	csrss.exe
3424	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpbtunf0vk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpbtunf0vk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpbtunf0vk.exe
File created	C:\Windows\rss\csrss.exe	tmpbtunf0vk.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4812	powershell.exe
4972	powershell.exe
1500	powershell.exe
1440	powershell.exe
952	powershell.exe
4380	powershell.exe
1856	powershell.exe
4076	powershell.exe
2764	powershell.exe
1724	powershell.exe
3616	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbtunf0vk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbtunf0vk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1488	schtasks.exe
1384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	powershell.exe
3616	powershell.exe
1860	tmpbtunf0vk.exe
1860	tmpbtunf0vk.exe
4812	powershell.exe
4812	powershell.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
2876	tmpbtunf0vk.exe
4972	powershell.exe
4972	powershell.exe
1500	powershell.exe
1500	powershell.exe
1440	powershell.exe
1440	powershell.exe
952	powershell.exe
952	powershell.exe
4076	powershell.exe
4076	powershell.exe
1796	csrss.exe
1796	csrss.exe
4380	powershell.exe
4380	powershell.exe
2764	powershell.exe
2764	powershell.exe
1856	powershell.exe
3200	csrss.exe
3200	csrss.exe
1856	powershell.exe
1724	powershell.exe
1724	powershell.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
4036	csrss.exe
4036	csrss.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
4036	csrss.exe
4036	csrss.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe
3424	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	1860	tmpbtunf0vk.exe
Token: SeImpersonatePrivilege	1860	tmpbtunf0vk.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	1796	csrss.exe
Token: SeImpersonatePrivilege	1796	csrss.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	3200	csrss.exe
Token: SeImpersonatePrivilege	3200	csrss.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeSystemEnvironmentPrivilege	4036	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 3616	1860	tmpbtunf0vk.exe	81
PID 2876 wrote to memory of 4812	2876	tmpbtunf0vk.exe	86
PID 2876 wrote to memory of 4716	2876	tmpbtunf0vk.exe	88
PID 4716 wrote to memory of 588	4716	cmd.exe	90
PID 2876 wrote to memory of 4972	2876	tmpbtunf0vk.exe	91
PID 2876 wrote to memory of 1500	2876	tmpbtunf0vk.exe	93
PID 2876 wrote to memory of 4036	2876	tmpbtunf0vk.exe	95
PID 4036 wrote to memory of 1440	4036	csrss.exe	96
PID 1796 wrote to memory of 952	1796	csrss.exe	100
PID 4036 wrote to memory of 4076	4036	csrss.exe	106
PID 3200 wrote to memory of 4380	3200	csrss.exe	116
PID 1660 wrote to memory of 2764	1660	csrss.exe	119
PID 4036 wrote to memory of 1856	4036	csrss.exe	121
PID 1560 wrote to memory of 1724	1560	csrss.exe	124
PID 4036 wrote to memory of 3424	4036	csrss.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpbtunf0vk.exe
"C:\Users\Admin\AppData\Local\Temp\tmpbtunf0vk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\tmpbtunf0vk.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpbtunf0vk.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:588
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1488
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3300
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3424
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1384

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2764

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 db82a4d7e23956506baa9e3b6f65001a64998fd0cd7bdc04ce0d8e05529ca3d9
MD5 d569ef5eaeb3926cd3da72c84e0c3916
SHA1 20cf77766cda6dbf7ec5190ff797ad1136b6d653
SHA512 e6787cc97e83fdb8cf7bbc74195a72202f19e598a105989c845af3709a67331d55568c262ff9e96717765148d9dece27fbc05cc69f1a573cd5f9616e80d5347a
SSDEEP 384:7L3HhwC1mS1gPjRtfFRHEUV8HnnNvjQGIsLj5TsUjcNayEIDXiJILOj9xFy:vxzmSURtNRboNvjfIsL9TxcNx9DXiOLH
TLSH
T1D292E69E711F26C3C89553B8D10A040FE8F2DE8D031956CCB72E8F7B89AC99E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 d543db45c9fa8c3083110d99e7885baa45107262e9b3dc7b7746f0112e3276f3
MD5 80d869d18f770cc8e6d27cd583157646
SHA1 56f8dff8f92fac2652001d2259db96de8abacb7b
SHA512 023396a79c1b2adab09298a9f394ba7413671b317e4ca9c070eb6463e4ecd3a1cba7a0ee90c646a5591dab0d4f85f783396dc99997c382a00780c6f804d43645
SSDEEP 384:CTHhwcs1SGAeLHYxo/m6RHEMEO3QeHTzHtjFK2hL9meRdq0GexyuqJWxXnnY9phL:ELMSjs4xz6RPEuTJjFBhL95RwYFGWBYt
TLSH
T188922959622F2A9BE46623F8C4220B8FF9F08DDFC34096DE6349583B01CB66554F95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ttr0kldp.ywt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttr0kldp.ywt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d8a72c3d2ac0bb991330481bc3da8ca28967b9784ffff1c91395b0a0539c2e64
MD5 5baae19b6c0477b573a3da7815d61ec9
SHA1 8b91e95124fb6c63625f4dba609bd69b362463a1
SHA512 539ab7d666504cd65c33a2de694c0e57a84bf8c354c1000667b6273eaedc4ba23b34faf9cba953baf7a7d86acfb8939658e1c5fdbafe6722dcc94984d13fa71f
SSDEEP 384:QTHhdS2g6pZFZFh3THfeHnot/Ca1krLLNvjC/7bSzrnY9jhUdkH:+SGNXR2m/Ca1eLN7A2zU9lUI
TLSH
T1BE922899222F369BE4A613F480260B97FDF09ECFC34493CE6356583B05CB67190A95ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 03f4b55ada280b0f11b20b1579105f41b19cb2a5a48e023879ace9f2f2c7e402
MD5 6279ec4b72ba046bb52ca1f94c1f175e
SHA1 bf4f2ab80fa5406768ccea269e8e917b21678245
SHA512 bf661d1296ace389f8da73682baeb6329eb2eccedc1cedd30b23e624dc74bf6dba872a4a957380fb78cda45046e51668d6008fc90660a72c933aed35bd4ed0eb
SSDEEP 384:sL3Hhz1S2YmK481NvcnN7jWa1ICOLNeog4G000zenY9jhUd9H:SvSTB4867jWa1ICOLNLPjzB9lUr
TLSH
T11E92285D325F26D7C8A923F8C026038FE9B09EDE430457DE675A5C3B05CA67184AD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 94b5a31fee886c72c47e461ef30e778585a0a86216ddee3775f3cb472091b002
MD5 9fc16dfbc86bc065fb437c1bcc92f0a6
SHA1 2e811dcb5ddb1ec277b2d6ad1a6dcb0cea1b2610
SHA512 04e780277d0cd60937e04bc609cab92c326e4054a86a303491dcbf9969068f3d5307c3a855ba75c7fae2cecc95cb3723edfe5b4e13c34c2a078e5bcdb2d8e914
SSDEEP 384:8L3HhwSS2Xi9mFhzEME5cHTzgwaK24F44GkfmDSnY9jhUdcH:iKSS2vh7E5IT5aB4B2D99lUg
TLSH
T1C8923A6D222F269BD4A923F9D02213DFE9B08ECE830053DE6758583B05CB271D4E95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 9c3e5b8d4bb6d1871575f348bc453162122bc22ae5e614ddda5d70e971dfa85f
MD5 b02f885c6dd132095e866d1ce3acc26d
SHA1 2904935f86b1ed61becb1cf38d767dddce0a96fa
SHA512 6540b7bbcb0aba7f6a4d56310064c44e72835fdefc94c6e9d632a4b5f693adc659cd2ea12d31c2a8c0a0a1929877cf0f42a5011ba62c758ff80d5d64754e2002
SSDEEP 384:UTHhz1S2vAVPHf8dovEMELHnHBCaK2eLNXWgqHbrfqzvnY9jhUdAH:+SoiHf8yXErhCaBeLNF+bezw9lUQ
TLSH
T1F4923A6A226F369BC4A513F8C026079BEDB08ECF838456DE5728583B05CF67184E56FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 64B
SHA256 9b8a9e3635a9545af511b51988bf98ba396096d4b185dc710bdbe5618eab4d14
MD5 3c9264ea6ae3bd3aa254f587936dc41f
SHA1 a4f7d8af5143cb4478d912820a10c0af6e849fa7
SHA512 84f25e5285d78c063058a647bb45e0bbac9b62500af743dd819c8b0d420500655f90a56ffa69557014ad63d5dd8efff7e7dcda513f144410e56276be7332a3a2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2e1131a76601aee100cf5c77631186042f53289632f7cda8d6c795a6d1157e07
MD5 9ce6ea3ba4381984dcc2217978693f19
SHA1 68c58b91b859edb39690de50064ea2548871047a
SHA512 82debdbc0b4c89399b4ad133ed5a0f6475adfd1a8de8bbc7473a06a2c584f25976b3bedc1c940dbacff6abad51fadea3f6449e84afb14eac51cd7f65be7af67b
SSDEEP 384:aL3HhwmSJIQsiOVIC+HnnNjjQGILs+NXjg29ZbrL3zoRjNKdFG:kKmSK5upNjjfILs+NzgGZbrLzoadQ
TLSH
T11D92D6AE715F12C3C89653B8D10B050FE8F2DE8D031A12D9BB2E9F7B89AC55E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ef6292471ca058a454bafa277494cbeead76d6b254cda7f56fdab3e767a7c141
MD5 244d646ed509ee7db9cb3b427720734b
SHA1 caa8c65c8a5dd5edbac152a704b69ac279510bb1
SHA512 27a0be65762fa2246d26238fcb9a7ecfe582b3acab23947ef271b09be294130aa3b1503eacf44e148c0850160e5302f72d10597f43fe22bbb52a9c624977746c
SSDEEP 384:WTHhv1SStC3robLKFRHEMEAHnNPCa1k2OLNX9HmHbfqzHnY9jhUdwH:MSSorzRPEAtPCa13OLNwbiz49lUg
TLSH
T1259218AD326F369BC4A913F88022079BEDB08EDF430453DE635A9D3B05CB6B144695ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 ce73f5d8a0d9382c0a1eee6acf7db89183ae009c5a472edcefa950ae2dfc063e
MD5 f848e5e94573f2d09e1aef116341070b
SHA1 358d266ee959110a044174d55e5c9e3ce60c6b58
SHA512 64b76777f5adcb4f4abde73bd99d98f251d96bde7fdbe51181271291ea9068b8822f5e0a0c84f39d999af30ed0ab5bd6f04220a827fbcac5c60e21f26d7c3a2e
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfchZytTD5iqz:sxEvYjVzANUhwN
TLSH
T1A7A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-141-0x0000000007F10000-0x0000000007F21000-memory.dmp

Download

memory/952-132-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/952-133-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/952-140-0x0000000007D50000-0x0000000007DF4000-memory.dmp

Download

memory/952-149-0x0000000005B30000-0x0000000005B45000-memory.dmp

Download

memory/1440-112-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/1440-110-0x0000000006210000-0x000000000625C000-memory.dmp

Download

memory/1440-130-0x0000000005FC0000-0x0000000005FD5000-memory.dmp

Download

memory/1440-129-0x00000000077E0000-0x00000000077F1000-memory.dmp

Download

memory/1440-108-0x0000000005C20000-0x0000000005F77000-memory.dmp

Download

memory/1440-113-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/1440-120-0x0000000007460000-0x0000000007504000-memory.dmp

Download

memory/1500-89-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/1500-90-0x0000000070E70000-0x00000000711C7000-memory.dmp

Download

memory/1724-219-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/1724-220-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/1724-230-0x0000000005F60000-0x0000000005F75000-memory.dmp

Download

memory/1856-212-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/1856-211-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/2764-204-0x0000000005BB0000-0x0000000005BC5000-memory.dmp

Download

memory/2764-186-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/2764-201-0x0000000007720000-0x0000000007731000-memory.dmp

Download

memory/2764-187-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/3616-31-0x0000000007C10000-0x0000000007CB4000-memory.dmp

Download

memory/3616-25-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/3616-1-0x00000000052F0000-0x0000000005326000-memory.dmp

Download

memory/3616-2-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/3616-3-0x00000000059D0000-0x0000000005FFA000-memory.dmp

Download

memory/3616-4-0x00000000058C0000-0x00000000058E2000-memory.dmp

Download

memory/3616-5-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3616-6-0x0000000006230000-0x0000000006296000-memory.dmp

Download

memory/3616-13-0x00000000063A0000-0x00000000066F7000-memory.dmp

Download

memory/3616-14-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/3616-15-0x00000000067B0000-0x00000000067FC000-memory.dmp

Download

memory/3616-40-0x0000000007E70000-0x0000000007E78000-memory.dmp

Download

memory/3616-39-0x0000000007E50000-0x0000000007E6A000-memory.dmp

Download

memory/3616-38-0x0000000007E00000-0x0000000007E15000-memory.dmp

Download

memory/3616-37-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

Download

memory/3616-36-0x0000000007DA0000-0x0000000007DB1000-memory.dmp

Download

memory/3616-35-0x0000000007E90000-0x0000000007F26000-memory.dmp

Download

memory/3616-34-0x0000000007D80000-0x0000000007D8A000-memory.dmp

Download

memory/3616-33-0x0000000007D40000-0x0000000007D5A000-memory.dmp

Download

memory/3616-32-0x0000000008380000-0x00000000089FA000-memory.dmp

Download

memory/3616-0-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/3616-30-0x0000000007BF0000-0x0000000007C0E000-memory.dmp

Download

memory/3616-23-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/3616-16-0x0000000006BA0000-0x0000000006BE6000-memory.dmp

Download

memory/3616-21-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/3616-17-0x000000007F6C0000-0x000000007F6D0000-memory.dmp

Download

memory/3616-18-0x0000000007BB0000-0x0000000007BE4000-memory.dmp

Download

memory/3616-19-0x0000000070B10000-0x0000000070B5C000-memory.dmp

Download

memory/3616-20-0x0000000070C90000-0x0000000070FE7000-memory.dmp

Download

memory/4076-169-0x0000000007E60000-0x0000000007E71000-memory.dmp

Download

memory/4076-170-0x00000000066A0000-0x00000000066B5000-memory.dmp

Download

memory/4076-152-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/4076-161-0x0000000007B20000-0x0000000007BC4000-memory.dmp

Download

memory/4076-153-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/4380-172-0x00000000714C0000-0x0000000071817000-memory.dmp

Download

memory/4380-171-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/4812-49-0x0000000005AF0000-0x0000000005E47000-memory.dmp

Download

memory/4812-61-0x00000000075D0000-0x00000000075E5000-memory.dmp

Download

memory/4812-50-0x0000000006080000-0x00000000060CC000-memory.dmp

Download

memory/4812-51-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/4812-52-0x0000000070E70000-0x00000000711C7000-memory.dmp

Download

memory/4812-59-0x0000000007230000-0x00000000072D4000-memory.dmp

Download

memory/4812-60-0x0000000007580000-0x0000000007591000-memory.dmp

Download

memory/4972-74-0x0000000071560000-0x00000000718B7000-memory.dmp

Download

memory/4972-73-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/4972-71-0x0000000006000000-0x0000000006357000-memory.dmp

Download