glupteba | 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpgs2fssd_.exe
Size 4.2MB
Sample260602-ll3lrabt5n
SHA256 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9
MD5 42149f8ec356bdf12748114fe2a2295f
SHA1 d2f8fbb889f8b8e28b98352dd3e17230a41f0893
SHA512 331480733f6cd4dbac6274475671005b720d0454df2d24c19907f3d58c53ae2e0db44f5f3125fa4073a03669a3a7ebc229c1e8423144f97093904a2df50d8e34
SSDEEP 98304:c6H24mpQm717nbjFmPd67NkwNcs1opl8cEKAHlzz3V+w4HSn:BHapQw17nbjFmPiNf1opXEKAZ8wuSn
TLSH
T134163302A2947FA0FA1A0F739F0DDBF856EE79910D153B9B1218691F01732F292736B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 22 IoCs

resource	yara_rule
behavioral2/memory/3532-2-0x0000000003040000-0x000000000392B000-memory.dmp	family_glupteba
behavioral2/memory/3532-49-0x0000000003040000-0x000000000392B000-memory.dmp	family_glupteba
behavioral2/memory/3532-48-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3708-119-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3708-120-0x0000000002C10000-0x000000000300D000-memory.dmp	family_glupteba
behavioral2/memory/3728-167-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1596-171-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-280-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3844-281-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/2672-284-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/820-285-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-287-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-293-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-299-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-305-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-311-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-317-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-323-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-329-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-335-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-341-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/3728-347-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4716	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3728	csrss.exe
1596	csrss.exe
3844	csrss.exe
2672	csrss.exe
820	csrss.exe
2748	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpgs2fssd_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpgs2fssd_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpgs2fssd_.exe
File created	C:\Windows\rss\csrss.exe	tmpgs2fssd_.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4272	powershell.exe
1616	powershell.exe
4996	powershell.exe
312	powershell.exe
2408	powershell.exe
2940	powershell.exe
2440	powershell.exe
452	powershell.exe
4716	powershell.exe
4984	powershell.exe
3412	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgs2fssd_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgs2fssd_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1684	schtasks.exe
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4272	powershell.exe
4272	powershell.exe
3532	tmpgs2fssd_.exe
3532	tmpgs2fssd_.exe
1616	powershell.exe
1616	powershell.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
3708	tmpgs2fssd_.exe
452	powershell.exe
452	powershell.exe
4996	powershell.exe
4996	powershell.exe
312	powershell.exe
312	powershell.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
1596	csrss.exe
1596	csrss.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
2672	csrss.exe
2672	csrss.exe
2748	injector.exe
2748	injector.exe
3412	powershell.exe
3412	powershell.exe
3412	powershell.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
3728	csrss.exe
3728	csrss.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe
3728	csrss.exe
3728	csrss.exe
2748	injector.exe
2748	injector.exe
2748	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	3532	tmpgs2fssd_.exe
Token: SeImpersonatePrivilege	3532	tmpgs2fssd_.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	1596	csrss.exe
Token: SeImpersonatePrivilege	1596	csrss.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeSystemEnvironmentPrivilege	3728	csrss.exe
Token: SeDebugPrivilege	2672	csrss.exe
Token: SeImpersonatePrivilege	2672	csrss.exe
Token: SeDebugPrivilege	3412	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4272	3532	tmpgs2fssd_.exe	93
PID 3708 wrote to memory of 1616	3708	tmpgs2fssd_.exe	98
PID 3708 wrote to memory of 4712	3708	tmpgs2fssd_.exe	100
PID 4712 wrote to memory of 4716	4712	cmd.exe	102
PID 3708 wrote to memory of 452	3708	tmpgs2fssd_.exe	103
PID 3708 wrote to memory of 4996	3708	tmpgs2fssd_.exe	105
PID 3708 wrote to memory of 3728	3708	tmpgs2fssd_.exe	107
PID 1596 wrote to memory of 312	1596	csrss.exe	112
PID 3728 wrote to memory of 2408	3728	csrss.exe	114
PID 3728 wrote to memory of 2940	3728	csrss.exe	122
PID 3844 wrote to memory of 2440	3844	csrss.exe	132
PID 3728 wrote to memory of 4716	3728	csrss.exe	134
PID 2672 wrote to memory of 4984	2672	csrss.exe	136
PID 3728 wrote to memory of 2748	3728	csrss.exe	139
PID 820 wrote to memory of 3412	820	csrss.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe
"C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2408
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1684
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2748
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4376

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:312
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 2c7e20db11abe315cbe07f3a7aa3f0465e560dd5f1f348f9399ed4c308eeb8a3
MD5 6b2bb56c1bb50ed2303270143e1fa209
SHA1 561b058e1a31766c1e11572e156fdf4f970e131d
SHA512 7ca79c98d5fe7486818804e37a125aee2e65d46bf620b5871db8a3568c9ce15602ffcbeed765bc2bee3ddb9d199288c373b81db6d97c9af9fd061a891ca874af
SSDEEP 384:Osf+hoJ9i+uirUAkxvNVhJWlowTJK6seYbneqx/xofLYbLU0WF5Xt9KyA/9JbAYs:bfA16VUlVhElowTJN+nFQY/XEXt9CzO3
TLSH
T1CFA2E75E618F16C3C4866378D11A041FE8F2DD8D431926D8BB1F8F7B8AAC6BF6178548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 e1ed60f072ac458e028b49479a4b8f1d6f79ca3bceb4b247372186fa6fef2440
MD5 ac6782e1380b55931607138d1d2c15cb
SHA1 2d2446f42952d79109b9266dcca51f972c3cc92c
SHA512 38aa946f6393f8d76d44fb08b960bc80c8874b3677edddeeebf969e937200cc5041afba30a0af085711318d263e8fb4cb6f28688b75babdc7aa0942462a7274d
SSDEEP 384:0sf+honZ2x9BBbxuizJk+o9oQTVK6b8FNpfNzPB3UDLYbY0toUIKJekhKMWKCA/3:BfAO2XDejoQTVN8FNpf1Pu/YvuUBEOKe
TLSH
T1AAA2274E521B2AD3C15A23B8C026439FD5B28DCF83009BCD774B4A27168BA7560B86F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_klooa3cg.m5n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_klooa3cg.m5n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2cfd1ad359775a9a4d6067e23f3e6455db3a4764350cf7dbccc7219fa397671b
MD5 685617afd49b948ea5c228a1cb328e4e
SHA1 f3be78fd37a8aeaf35c212890a755222adcb2cf1
SHA512 4748d05dd43b649231c31465daac381889287a25338596629fba3a647387f5008268ee3c967813a3424a9f054fa239d0f6556d2ebe138c098cd532186330a1e0
SSDEEP 384:n6+BHRBQ451Z//7neAloSvd+ETfYFFNpfemxw7/ZiaMhJu1EN+nFbOuj3lup2Og:6EQk1/ySPvd+ETf8FNpfQ7vYQ1H4ublH
TLSH
T1E192299E621F2AD7C4A613F4C43743EBD9B09ECE930007CD678A693B06CAA7554691FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8d12dec910dd37f5d2603a8d95d60a8f2cc8b1c380e962dc452c98fc7552c6dd
MD5 c398d6fe6a84d2a66cc55ed4d3e2ae83
SHA1 8eb5c39af01cdc56f02776b3beea7afb1d0bd8cb
SHA512 2e66b255cda3ff450f3a66b2febf8253f0aa460015640f2d31380a81b68b26b64cc57f5d7937f1ac538bd23c528b46ca30646b40a500515c5dc6afb2aa0f7097
SSDEEP 384:Msf+BSHBafe97tyzqM04to9o5wNYFFjffemy7/IOq01Jm1uAP+nFbOuj3l/cOg:pfNafe760lo5wN8Fjff47lQ1up4ublk
TLSH
T15F92285D221F1AD6E72223B4C4264BEFF8F09DCBC34406DE57851A3906EA7B684D91F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b9e376b5db4044c7c4325c92f3f4ef583333cb67e040932a22a86335d556a8f3
MD5 e38bef15b38f6cc852e556c55f95861d
SHA1 46b0b038deddb30960e9bd15e9dc08fe5d936c4f
SHA512 88cff36f2777e6ff40972f2c24581cdded772df7dabc3397e7cd7e686fa92b5da974ae0e8fe1fd70dc4bd43f254eb3ea54d825b4abb3025e404baeaa8ba912c3
SSDEEP 384:Ksf+BS9m+Lv0MEBlqBilPp/RLTo4zu1NYFFjffemdw7/ZqPM1oEL13jxD+nFbOu+:3f/v0MEjqolJ9i1N8Fjffc7akF13I4u+
TLSH
T18392195D621F2AD7D0A513F8C42A47DFE5B09DCFC3000BDD66895E3B0ACA67684AC1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1e0819b44d4b187b8c9a2cee22523db6ae6691f7de683bcbdcf1167802606d55
MD5 d7aa632fc54329ea5875902052b75b08
SHA1 6231f651ec56983d472c2af2800654250dbcf3dd
SHA512 400f3cb99a62a755ff2108b66650ac6964e9618441bfbe109e81060b1df526683ba3a25dc90ee38c9bfae28ec85fd4d8e3128c0a4b918e523eae0afd94688f70
SSDEEP 384:C8sf+BHRBh75QsONho9o5ARNYFFNpfem1c7/IORuT1Ytoky1EY+nFbOuj3lu1Og:C5fEh7OSo5ARN8FNpfY7SUk1a4ublU
TLSH
T14692085D621F2A96F02613B0D42A4BDBFDB0ADCFC38006DE57411E37069BBB584E51E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6565c061d8b77045c6652b48469965501fd688556ec928ccf8a368418d9b0292
MD5 f87e644ed147eb8805ba2e1f09a56d95
SHA1 22f71bef81295f84b6935c803e2d18467f77af0c
SHA512 0392526789393f7be4f4e2d39d16ce2d61759072744eb64a3ba18ebe63fdbfcf965b057b8f16013506d570226b1e50184b1c7975db3d7599602171f295e6459b
SSDEEP 384:fsf+BsRB+BRtgvSB6AhXk+o9dNYFFNpfemFk7/ZGPMVdC1Prr+nFbOuj3lu3pOg:UfN+tgKYAujdN8FNpfg7WE41u4ublw
TLSH
T10792079D620F3AD7C0A613F4C42647EFE9B09ECEC30047DD67855A3B06CAB7594A91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6afd81bc4ba7bd8e2206ff8a25af9e4df922bbb8925ecbd6c4e1da15d038958f
MD5 5523e33004945d9c3b7632eb4d5ad6e1
SHA1 b93a854b95eabdc5d7d7711a3d0161ba9e45d9b4
SHA512 dc70566969c7a78287b0a6b72a240d01b7218cd4aa1d980df676ddeb88f7b75585db0fae06f0b98416348eb0e291887deccb2931f4cb7dd1e68628c898c20d3d
SSDEEP 384:9sf+Bi9m+rR/F0J2sWVzk0o9oVVK6seYbnei8v/ZFwMHVOuEIjaL0LZbObTUSyR:ifHR/FQXnZoVVN+n4vxOuEI5FqMdR
TLSH
T1CF92095E201F16C3C48613B8D117054FE8F2EE8D531A17D9BB1E9F3B8AACA9E913C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.2MB
SHA256 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9
MD5 42149f8ec356bdf12748114fe2a2295f
SHA1 d2f8fbb889f8b8e28b98352dd3e17230a41f0893
SHA512 331480733f6cd4dbac6274475671005b720d0454df2d24c19907f3d58c53ae2e0db44f5f3125fa4073a03669a3a7ebc229c1e8423144f97093904a2df50d8e34
SSDEEP 98304:c6H24mpQm717nbjFmPd67NkwNcs1opl8cEKAHlzz3V+w4HSn:BHapQw17nbjFmPiNf1opXEKAZ8wuSn
TLSH
T134163302A2947FA0FA1A0F739F0DDBF856EE79910D153B9B1218691F01732F292736B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-123-0x0000000005420000-0x0000000005774000-memory.dmp

Download

memory/312-132-0x00000000061E0000-0x000000000622C000-memory.dmp

Download

memory/312-152-0x0000000005AE0000-0x0000000005AF4000-memory.dmp

Download

memory/312-144-0x0000000005AA0000-0x0000000005AB1000-memory.dmp

Download

memory/312-133-0x0000000070C50000-0x0000000070C9C000-memory.dmp

Download

memory/312-142-0x00000000072B0000-0x0000000007353000-memory.dmp

Download

memory/312-134-0x0000000071A50000-0x0000000071DA4000-memory.dmp

Download

memory/452-85-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

Download

memory/452-86-0x0000000070E70000-0x00000000711C4000-memory.dmp

Download

memory/452-83-0x00000000062F0000-0x0000000006644000-memory.dmp

Download

memory/820-285-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/1596-171-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/1616-70-0x0000000007290000-0x0000000007333000-memory.dmp

Download

memory/1616-61-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

Download

memory/1616-72-0x00000000075F0000-0x0000000007604000-memory.dmp

Download

memory/1616-71-0x00000000075A0000-0x00000000075B1000-memory.dmp

Download

memory/1616-62-0x0000000070EA0000-0x00000000711F4000-memory.dmp

Download

memory/1616-59-0x00000000059F0000-0x0000000005D44000-memory.dmp

Download

memory/1616-60-0x00000000060E0000-0x000000000612C000-memory.dmp

Download

memory/2408-169-0x0000000005960000-0x0000000005974000-memory.dmp

Download

memory/2408-168-0x0000000007120000-0x0000000007131000-memory.dmp

Download

memory/2408-156-0x0000000070C50000-0x0000000070C9C000-memory.dmp

Download

memory/2408-157-0x0000000071A50000-0x0000000071DA4000-memory.dmp

Download

memory/2408-165-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Download

memory/2440-203-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/2440-223-0x00000000067F0000-0x0000000006804000-memory.dmp

Download

memory/2440-214-0x0000000008000000-0x0000000008011000-memory.dmp

Download

memory/2440-204-0x0000000071310000-0x0000000071664000-memory.dmp

Download

memory/2672-284-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/2940-200-0x00000000079C0000-0x0000000007A63000-memory.dmp

Download

memory/2940-184-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/2940-201-0x0000000006570000-0x0000000006581000-memory.dmp

Download

memory/2940-185-0x0000000071310000-0x0000000071664000-memory.dmp

Download

memory/2940-212-0x00000000065B0000-0x00000000065C4000-memory.dmp

Download

memory/2940-172-0x0000000006110000-0x0000000006464000-memory.dmp

Download

memory/2940-182-0x0000000006CD0000-0x0000000006D1C000-memory.dmp

Download

memory/3412-270-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/3412-271-0x0000000071310000-0x0000000071664000-memory.dmp

Download

memory/3532-2-0x0000000003040000-0x000000000392B000-memory.dmp

Download

memory/3532-1-0x0000000002C30000-0x0000000003032000-memory.dmp

Download

memory/3532-48-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3532-49-0x0000000003040000-0x000000000392B000-memory.dmp

Download

memory/3708-120-0x0000000002C10000-0x000000000300D000-memory.dmp

Download

memory/3708-51-0x0000000002C10000-0x000000000300D000-memory.dmp

Download

memory/3708-119-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-167-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-329-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-305-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-311-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-317-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-280-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-323-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-299-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-335-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-287-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-341-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-347-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3728-293-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3844-281-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/4272-35-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/4272-3-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/4272-8-0x0000000006210000-0x0000000006276000-memory.dmp

Download

memory/4272-16-0x0000000006280000-0x00000000065D4000-memory.dmp

Download

memory/4272-17-0x0000000006850000-0x000000000686E000-memory.dmp

Download

memory/4272-18-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/4272-19-0x0000000006DB0000-0x0000000006DF4000-memory.dmp

Download

memory/4272-20-0x0000000007B60000-0x0000000007BD6000-memory.dmp

Download

memory/4272-21-0x0000000008260000-0x00000000088DA000-memory.dmp

Download

memory/4272-22-0x0000000007C00000-0x0000000007C1A000-memory.dmp

Download

memory/4272-6-0x0000000005970000-0x0000000005992000-memory.dmp

Download

memory/4272-23-0x000000007FCB0000-0x000000007FCC0000-memory.dmp

Download

memory/4272-5-0x00000000059D0000-0x0000000005FF8000-memory.dmp

Download

memory/4272-45-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/4272-44-0x0000000008070000-0x000000000808A000-memory.dmp

Download

memory/4272-43-0x0000000007F80000-0x0000000007F94000-memory.dmp

Download

memory/4272-4-0x0000000005290000-0x00000000052C6000-memory.dmp

Download

memory/4272-42-0x0000000007F70000-0x0000000007F7E000-memory.dmp

Download

memory/4272-41-0x0000000007F30000-0x0000000007F41000-memory.dmp

Download

memory/4272-7-0x0000000006070000-0x00000000060D6000-memory.dmp

Download

memory/4272-25-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/4272-24-0x0000000007DC0000-0x0000000007DF2000-memory.dmp

Download

memory/4272-26-0x0000000070D70000-0x00000000710C4000-memory.dmp

Download

memory/4272-37-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/4272-36-0x0000000005390000-0x00000000053A0000-memory.dmp

Download

memory/4272-38-0x0000000007E20000-0x0000000007EC3000-memory.dmp

Download

memory/4272-34-0x0000000007E00000-0x0000000007E1E000-memory.dmp

Download

memory/4272-40-0x0000000007FD0000-0x0000000008066000-memory.dmp

Download

memory/4272-39-0x0000000007F10000-0x0000000007F1A000-memory.dmp

Download

memory/4716-232-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/4716-233-0x0000000071310000-0x0000000071664000-memory.dmp

Download

memory/4984-242-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/4984-253-0x00000000078D0000-0x00000000078E1000-memory.dmp

Download

memory/4984-243-0x0000000071310000-0x0000000071664000-memory.dmp

Download

memory/4996-104-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

Download

memory/4996-100-0x0000000005440000-0x0000000005794000-memory.dmp

Download

memory/4996-105-0x0000000071490000-0x00000000717E4000-memory.dmp

Download