glupteba | d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpjiezv4qg.exe
Size 9.1MB
Sample260602-mfd7msaz8x
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001400000002b192-101.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5824	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
1620	csrss.exe
4732	csrss.exe
5728	csrss.exe
2216	csrss.exe
3440	csrss.exe
4492	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpjiezv4qg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpjiezv4qg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpjiezv4qg.exe
File created	C:\Windows\rss\csrss.exe	tmpjiezv4qg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1812	powershell.exe
6016	powershell.exe
3300	powershell.exe
4556	powershell.exe
4884	powershell.exe
5316	powershell.exe
5924	powershell.exe
5400	powershell.exe
3024	powershell.exe
5772	powershell.exe
4900	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpjiezv4qg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpjiezv4qg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4308	schtasks.exe
1188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5924	powershell.exe
5924	powershell.exe
1260	tmpjiezv4qg.exe
1260	tmpjiezv4qg.exe
5400	powershell.exe
5400	powershell.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
5132	tmpjiezv4qg.exe
1812	powershell.exe
1812	powershell.exe
6016	powershell.exe
6016	powershell.exe
3024	powershell.exe
3024	powershell.exe
3300	powershell.exe
3300	powershell.exe
5772	powershell.exe
5772	powershell.exe
4732	csrss.exe
4732	csrss.exe
4556	powershell.exe
4556	powershell.exe
4900	powershell.exe
4900	powershell.exe
4884	powershell.exe
4884	powershell.exe
2216	csrss.exe
2216	csrss.exe
5316	powershell.exe
5316	powershell.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
1620	csrss.exe
1620	csrss.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
1620	csrss.exe
1620	csrss.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe
4492	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeDebugPrivilege	1260	tmpjiezv4qg.exe
Token: SeImpersonatePrivilege	1260	tmpjiezv4qg.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeDebugPrivilege	4732	csrss.exe
Token: SeImpersonatePrivilege	4732	csrss.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	2216	csrss.exe
Token: SeImpersonatePrivilege	2216	csrss.exe
Token: SeDebugPrivilege	5316	powershell.exe
Token: SeSystemEnvironmentPrivilege	1620	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 5924	1260	tmpjiezv4qg.exe	82
PID 5132 wrote to memory of 5400	5132	tmpjiezv4qg.exe	87
PID 5132 wrote to memory of 1820	5132	tmpjiezv4qg.exe	89
PID 1820 wrote to memory of 5824	1820	cmd.exe	91
PID 5132 wrote to memory of 1812	5132	tmpjiezv4qg.exe	92
PID 5132 wrote to memory of 6016	5132	tmpjiezv4qg.exe	94
PID 5132 wrote to memory of 1620	5132	tmpjiezv4qg.exe	96
PID 1620 wrote to memory of 3024	1620	csrss.exe	97
PID 4732 wrote to memory of 3300	4732	csrss.exe	101
PID 1620 wrote to memory of 5772	1620	csrss.exe	107
PID 5728 wrote to memory of 4556	5728	csrss.exe	118
PID 2216 wrote to memory of 4900	2216	csrss.exe	120
PID 1620 wrote to memory of 4884	1620	csrss.exe	122
PID 3440 wrote to memory of 5316	3440	csrss.exe	125
PID 1620 wrote to memory of 4492	1620	csrss.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpjiezv4qg.exe
"C:\Users\Admin\AppData\Local\Temp\tmpjiezv4qg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Users\Admin\AppData\Local\Temp\tmpjiezv4qg.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpjiezv4qg.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3024
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4308
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4492
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1188

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 5813321c8b4796e37093d15b315a8209e97ce982dfb9d85356d2ee0e75376b14
MD5 eefee1c1cf8b0d4479c2df42c21bd40b
SHA1 bdda6775dfec154372d09fdca7a8130982d37d14
SHA512 1a75cc538502ccdceda2e456d599649c585cc00885b0c4a7eb5cc03d5b116ab0f6a27b2ccfd3521123c83cebc6d058bba34c6a9c9285e64236ba6a8e07ef37dd
SSDEEP 384:tL3HhwwiS1Qq71VSJP9kjnnNjjQGIZaLj5fsUjj+GyEID3iJALOj9FFy:lxJiSp7WlINjjfIZaL9fxj+F9D3i2LKA
TLSH
T18292D69E711F16C3C88663B8D206040FE8F2DE8D03195ADDB72E8F7B89AC99E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 ea1500c27cffb216df9eacd39d5ffdc6feb3735a21ebfd79b9266c1974ed8834
MD5 eb2311e5acf0188b1a8801709f04eff3
SHA1 f6c5c8410f8d4542396f7d33cfeb2de2fd2531bc
SHA512 4451fb48ab34bc8a7be5cc2cc8f15b443f522f6e47ea373ba7e2afd5720298477fcde651b369e61ba778b44ec95dbf5003db34a346de9b454341434da9c2878b
SSDEEP 384:2THhwzsGIpHUZzheRJT0eFczHtjWaK2h2G5Vdq4GevD90WxLnnY9phAUd5H:w1vqcRVCpjWaBhZ5VwQDuWlY9p2UT
TLSH
T18A924A59225F26DBE4A523B8C022078FF1F08EDEC34056DDA35DA93B05DE26584BDADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lwchby53.fzm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwchby53.fzm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d9ce5a145869a2a98a2945de00afdca7d28a6f3b2daf89d061e7a21f0e575309
MD5 e9c4617f569316c8ea505eff0e815a57
SHA1 bfde18bb03ebb9ae2a1d847a23a507d4a8d2d4f9
SHA512 13b61210861ca81abbe9fb9f1d4d0120ebf56ab8609431877751afd02f35035fdd68fbae431bc956fb20d138da434b05eaa7e93f11747f8e63461720f58324f5
SSDEEP 384:LL3Hhz1SStDSpXnGRFRHEMlLmDyHnpjWaK2uLNeoC/4bbfSzCnY9jhUdkH:/vSSk1G/RPzpjWaBuLNLvb2zt9lU0
TLSH
T13492276D221F26DBD4AA13F4C0220B9FE9F08ECF830453DE6314AD3B05CB67594A95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c4b9b5b73e5f779e3b30ed15827920a200d0ba280255b12052c8ab11896ccdd5
MD5 aef15640c911f4eea012e9352900e9d9
SHA1 a9f840c3d7e9941a49dcec53ceaf7426a6fed5de
SHA512 fb5bf51c6167c326924954b54796e2b392688ecec2ffb5b6d87ae8c03ee63f155def7789da3905aae14165aa3aca82dc1ab1dad7e73f16243a2e7845e19df51e
SSDEEP 384:tL3HhpSSQSr6wFRHEMEMbOLZoQumFMLCa1ICOLNXj5q4G00M6ienY9jhUd9H:lfSSlr6oRPEjLvufLCa1ICOLNz5ZD6ic
TLSH
T18592299D726F26DBC4A523B9C022039BE9B08ECE430493DDA71A5D3F05CE271546C5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 99daecb7b55fb54a1bd19e9dad7f7530ec39575e6fe8a52b59da288b80b06fdd
MD5 32ef9ff8c211c98604d59b31593be784
SHA1 12443dbd0525f90d077547cb1a8cf827b94f68ca
SHA512 a84f31eaee3b6b9d8cdf436c43a1d60c54f75917ad69cc8bdec7b3b6195fef66e5ccc0d5ccb7d68c9bf3d94e46d285bb8e735aee3ed4b09b8ffa1d5fa250ccd5
SSDEEP 384:xL3Hhz1SSt7yrdbTefHTDV/jWa1k2uLNXjA4bu6iCnY9jhUdUH:5vSS8dbiPTp/jWa13uLNzvbu6it9lUo
TLSH
T12692286D226F2697C4A513F4C01607DBEAF08ECF834453DE631A9D3F16CE6B184984E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8ba862308f156a341c3de07a9a16d51663679f39604253649e7b5eb4bf4591e9
MD5 75f2a4e047a7bdf19f9f34065cab55fe
SHA1 570904fbc1534680eefb8c25247ae70234b9fa2b
SHA512 23085fc780f22d9d415a49ac28a60824483c73c9b46feceba8d87b97cc0b24fdd325585d607e829a8455607c4c465acff65244f35d7149cff91f4c5016f9efc3
SSDEEP 384:QTHhz1S2kR2ZT5sFRHEMEOOzDHnNjc2OLNXEHbI0zFS2nY9jhUd9H:6S3gZWRPEljvOLNUbHzFC9lUr
TLSH
T1C792285D226F2687E06613F9D0221BDFFEF09ECEC30496DE92158D3B00CB27184A95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c72c08834007b893be220fff5b633e9732f332444c49df1da1e3008962747fa1
MD5 d47f728c8033a6f0f74807f0d391d4bf
SHA1 76dd15f62dedc013b19633a8656d9aa0016c26d5
SHA512 fdf51935d8b186f4f8d3501a33e5a14325cbdc571d9cf5b8e6124fc4cf40d0df33346493e8a0bd35ac5205a3f11de7e27f54064fc78753c6032c62b8649700ff
SSDEEP 384:1THhpS2kjQZ7HRufclpHnNjc2OLNXEHbbz/nY9jhUdRH:pS3W7HRufo9NjvOLNUbbzA9lUb
TLSH
T141921999226F22D7D4A523F8C026039BFDB09ECF830457DE5748993B05CF6B184985ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 0c909acd3fea7a82fbff75ad49edfd85413deefdd2cbb2fcd55e63e56c5610ba
MD5 b21770ba07dcc3de8419959cff635fd8
SHA1 d6fefbfa021d414ad2e5a42dce77e47782968736
SHA512 51da4971e85634208e7f826179ba744bbf2dc2413c72f7c6ae319d0f9939f5061db0d92f0276256fa17a14db5847a67f11491e28a976ef6dde4148a8c096710e
SSDEEP 384:GTHhwiSJSjYR9KFRHEMa/HnnNzjQGII+NXjg2x+b3zHz5RjNadF+:piSsYRwRPavNzjfII+NzgC+b3zz5Kdk
TLSH
T11A92C5AEB11F22C3C89553B8D10A050FE8F2DE8D031A53D9B72E9F7B89AC95E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 568d7d309af42ee7e5ec561f24750ddd6abdf03f3bf8ba3acfa0537c24630f3e
MD5 437aecaa3f8181467e9ddc975c45a557
SHA1 d50a56dda836f74b56ec194ab0b067dbe29a49d1
SHA512 5307d978c2087cf603a07703cdcc5c7c0d2bb846c7a1562b880840bd14096641742b9c4772d2e0b8dcd01a089b369a17afffbfda11427e426ca9deee310f1396
SSDEEP 384:SL3Hhwi2CUWh/REnDtZHPHntjfICmLNeFqrA4bazSnY9jhUdN7H:cKiWkRUDtZftjfICmLN6qjbaz99lUv
TLSH
T1C19228AD226F26DBD49413B8C026039FF8F09ECF834053EE67196D3B05CE27594A81E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-74-0x0000000071270000-0x00000000715C7000-memory.dmp

Download

memory/1812-73-0x0000000071020000-0x000000007106C000-memory.dmp

Download

memory/1812-70-0x0000000005DF0000-0x0000000006147000-memory.dmp

Download

memory/3024-138-0x0000000006300000-0x0000000006315000-memory.dmp

Download

memory/3024-128-0x0000000007770000-0x0000000007814000-memory.dmp

Download

memory/3024-112-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Download

memory/3024-121-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/3024-108-0x0000000005F80000-0x00000000062D7000-memory.dmp

Download

memory/3024-120-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/3024-129-0x0000000007AA0000-0x0000000007AB1000-memory.dmp

Download

memory/3300-131-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/3300-130-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/4556-176-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/4556-175-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/4884-199-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/4884-200-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/4900-189-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/4900-190-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/5316-218-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/5316-217-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/5400-50-0x00000000066E0000-0x000000000672C000-memory.dmp

Download

memory/5400-51-0x0000000071020000-0x000000007106C000-memory.dmp

Download

memory/5400-52-0x00000000711C0000-0x0000000071517000-memory.dmp

Download

memory/5400-59-0x0000000007490000-0x0000000007534000-memory.dmp

Download

memory/5400-60-0x00000000077C0000-0x00000000077D1000-memory.dmp

Download

memory/5400-61-0x0000000007810000-0x0000000007825000-memory.dmp

Download

memory/5400-49-0x0000000005D90000-0x00000000060E7000-memory.dmp

Download

memory/5772-158-0x0000000007310000-0x00000000073B4000-memory.dmp

Download

memory/5772-150-0x00000000710B0000-0x00000000710FC000-memory.dmp

Download

memory/5772-166-0x0000000005A80000-0x0000000005A95000-memory.dmp

Download

memory/5772-159-0x00000000076C0000-0x00000000076D1000-memory.dmp

Download

memory/5772-151-0x0000000071190000-0x00000000714E7000-memory.dmp

Download

memory/5924-6-0x0000000006340000-0x00000000063A6000-memory.dmp

Download

memory/5924-16-0x0000000007A10000-0x0000000007A56000-memory.dmp

Download

memory/5924-19-0x0000000070F10000-0x0000000070F5C000-memory.dmp

Download

memory/5924-14-0x0000000006890000-0x00000000068AE000-memory.dmp

Download

memory/5924-13-0x00000000063B0000-0x0000000006707000-memory.dmp

Download

memory/5924-21-0x00000000034D0000-0x00000000034E0000-memory.dmp

Download

memory/5924-31-0x0000000007D20000-0x0000000007DC4000-memory.dmp

Download

memory/5924-30-0x0000000007D00000-0x0000000007D1E000-memory.dmp

Download

memory/5924-40-0x0000000007F50000-0x0000000007F58000-memory.dmp

Download

memory/5924-39-0x0000000007F60000-0x0000000007F7A000-memory.dmp

Download

memory/5924-38-0x0000000007F10000-0x0000000007F25000-memory.dmp

Download

memory/5924-0-0x00000000034D0000-0x00000000034E0000-memory.dmp

Download

memory/5924-17-0x000000007F1F0000-0x000000007F200000-memory.dmp

Download

memory/5924-18-0x0000000007CC0000-0x0000000007CF4000-memory.dmp

Download

memory/5924-23-0x00000000034D0000-0x00000000034E0000-memory.dmp

Download

memory/5924-15-0x00000000068E0000-0x000000000692C000-memory.dmp

Download

memory/5924-1-0x00000000033C0000-0x00000000033F6000-memory.dmp

Download

memory/5924-2-0x00000000034D0000-0x00000000034E0000-memory.dmp

Download

memory/5924-5-0x00000000062D0000-0x0000000006336000-memory.dmp

Download

memory/5924-37-0x0000000007F00000-0x0000000007F0E000-memory.dmp

Download

memory/5924-36-0x0000000007EB0000-0x0000000007EC1000-memory.dmp

Download

memory/5924-35-0x0000000007FA0000-0x0000000008036000-memory.dmp

Download

memory/5924-34-0x0000000007E90000-0x0000000007E9A000-memory.dmp

Download

memory/5924-4-0x0000000005AF0000-0x0000000005B12000-memory.dmp

Download

memory/5924-33-0x0000000007E50000-0x0000000007E6A000-memory.dmp

Download

memory/5924-32-0x0000000008490000-0x0000000008B0A000-memory.dmp

Download

memory/5924-3-0x0000000005BF0000-0x000000000621A000-memory.dmp

Download

memory/5924-20-0x0000000071090000-0x00000000713E7000-memory.dmp

Download

memory/5924-22-0x00000000034D0000-0x00000000034E0000-memory.dmp

Download

memory/6016-89-0x0000000071020000-0x000000007106C000-memory.dmp

Download

memory/6016-90-0x0000000071270000-0x00000000715C7000-memory.dmp

Download