glupteba | 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpnpubrevm.exe
Size 4.1MB
Sample260602-mg2dkacs6p
SHA256 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303
MD5 a49b82957f9728361ef050399b1201e1
SHA1 fb8fadf9edf93404cf5296e021788fe0319b3f51
SHA512 2c054945c291cc3a9d2e0fa8f2d4aa0d0faf8164e1b227c7831e0e7d733ec2bd40989618706041b1a797aa7250781b93026fd1ebbbd14c3d6adbb37b1ac60b56
SSDEEP 98304:39Zizxyr+yMV/mMXcm0UGc/CU5/uqvcHXM/fnEtY7OVaXxdW4cFpabf:NgAMoM+E7x/EVaXxdWZLy
TLSH
T1661633517150FCB1E3D653312D54E1A01919BC916F63C2BBA9236E3BFE743A3CA50BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

resource	yara_rule
behavioral2/memory/4660-2-0x00000000050C0000-0x00000000059AB000-memory.dmp	family_glupteba
behavioral2/memory/4660-49-0x00000000050C0000-0x00000000059AB000-memory.dmp	family_glupteba
behavioral2/memory/4660-59-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/4968-102-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/4968-117-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/2524-185-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-195-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/4412-257-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/700-258-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-278-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/4256-280-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-283-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-288-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-293-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-298-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-303-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-308-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-313-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-318-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral2/memory/3576-323-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3512	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3576	csrss.exe
2524	csrss.exe
4412	csrss.exe
700	csrss.exe
4948	injector.exe
4256	csrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpnpubrevm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpnpubrevm.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpnpubrevm.exe
File created	C:\Windows\rss\csrss.exe	tmpnpubrevm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
612	powershell.exe
2000	powershell.exe
3136	powershell.exe
4408	powershell.exe
1532	powershell.exe
4232	powershell.exe
4056	powershell.exe
4004	powershell.exe
1492	powershell.exe
4228	powershell.exe
1748	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpnpubrevm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpnpubrevm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe
2240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe
4660	tmpnpubrevm.exe
4660	tmpnpubrevm.exe
4408	powershell.exe
4408	powershell.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
4968	tmpnpubrevm.exe
1532	powershell.exe
1532	powershell.exe
1748	powershell.exe
1748	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
2524	csrss.exe
2524	csrss.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
4412	csrss.exe
4412	csrss.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
3576	csrss.exe
3576	csrss.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
4948	injector.exe
3576	csrss.exe
3576	csrss.exe
4948	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	4660	tmpnpubrevm.exe
Token: SeImpersonatePrivilege	4660	tmpnpubrevm.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	2524	csrss.exe
Token: SeImpersonatePrivilege	2524	csrss.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	3576	csrss.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4412	csrss.exe
Token: SeImpersonatePrivilege	4412	csrss.exe
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3136	4660	tmpnpubrevm.exe	93
PID 4968 wrote to memory of 4408	4968	tmpnpubrevm.exe	98
PID 4968 wrote to memory of 4688	4968	tmpnpubrevm.exe	102
PID 4688 wrote to memory of 3512	4688	cmd.exe	104
PID 4968 wrote to memory of 1532	4968	tmpnpubrevm.exe	105
PID 4968 wrote to memory of 1748	4968	tmpnpubrevm.exe	107
PID 4968 wrote to memory of 3576	4968	tmpnpubrevm.exe	112
PID 3576 wrote to memory of 4232	3576	csrss.exe	118
PID 2524 wrote to memory of 612	2524	csrss.exe	120
PID 3576 wrote to memory of 4056	3576	csrss.exe	126
PID 3576 wrote to memory of 4004	3576	csrss.exe	139
PID 4412 wrote to memory of 1492	4412	csrss.exe	141
PID 700 wrote to memory of 4228	700	csrss.exe	143
PID 3576 wrote to memory of 4948	3576	csrss.exe	145
PID 4256 wrote to memory of 2000	4256	csrss.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe
"C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4232
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2592
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4736
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4948
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2240

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 3594d3c4b1f881cd49c31ca8eb50121fe9bfb128a981e1649adb75afac412a2b
MD5 f7c12daee0b2fb4f631321dc992942d3
SHA1 8406486fe573f2a3d27b3e50abc3253d6f6ea009
SHA512 93d24167ac28137d094ee4a23c9eefa5b9dad6a9992170214a3fd65e24ee183439d3df5228c948a31a0c3dc8374dc7c33aaaaf908edb5d2c8404a9d1a80d9e88
SSDEEP 384:tsf+hom9i+udqFmfqJHOn06kUo9o2TpK6seYbneCx/xoTLYbLU0uF5Lt9KqA/9JU:yfAid3+unG5o2TpN+nl0Y/XcLt96fOKK
TLSH
T1C9A2E85E618F16C3C4861378D10A045FE8F2DE8D431926D8BB1F8F7B8A6C6BFA179148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 84a07b9d76aedcde5e1ed0af1abfa5250406a3695fb889904f0f7614bca3e7dc
MD5 4f8bbb8825dbdfc44b945c3d8f670c5b
SHA1 4d732dfa383634263910826945a7b8c4e4479724
SHA512 40b77d2e8d3b2d731241ebbee60e6e928b6f721f53a144bb97bbefcb005e025d5d1f0dcef8560962729ebaaddea21d35eba6fcc284264bfaa09fcbbe42173806
SSDEEP 384:k6+hoH91N9uAk85JkT3dz/5ATVK6pOFNpfNzJ39cFDsX0QoUIrJekhLWKWvchTdJ:lAIN8ARIbJ/5ATVLOFNpf1cFwWU0EOKa
TLSH
T136A23A5A622F2AD7C0AA23F9C43643DFD570CDCF83001BCD668E553B168AA7164F95E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yasq1m0u.1w2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yasq1m0u.1w2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 935e2312dd8ec93d85f33b099db28eaacd59e2b6c2c87a271631e73640abcc1f
MD5 7c8f9fcbc14bcb3c0370a629a6364aab
SHA1 1e582100793276acfeda74535db05baf0845ca7c
SHA512 77919677074192a8c392d092755b9ffa3836d71425ce127734c0d964dd06e319f0b9892a76c02b0dfdd31880216631e2378471a9704930b0a734c4505df1f2cd
SSDEEP 384:Q8i+Bh9RBa2dOoBieJkBo9o2TJNYFFNpfemRwUOockDowD81RjaR+nFbOuj3luuy:QFUa2Vojyo2TJN8FNpfAt2I1RZ4ublY
TLSH
T19E92299D212F3A97C0A513F8C42A43DBD9709DCF83040BDD669A6E3706DA7B584BC1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ee43012219fbd6e6fe43615d698e9b41c59beb8a9088aa11c6e624b0e1cf1c4f
MD5 367e9269b631897b5b680287dfdce3c4
SHA1 6b2be04c2bdc1b423f377b03181b81171884000e
SHA512 82cd0d2c6b7b8955f039d6305bb8dc07b526a53eb95df256d565ca3109aca9155943cb1bd4dd8fccadea2e1bd5d07c9efb15f3088ccce26cf3c5a8ad68046669
SSDEEP 384:G86+BnRBa575WgBbxXRzJk+o9o2TPNYFpfNW7/IOKXlJQ12x+nFbOuj3lP0Og:G9Ua/4jo2TPNKpf87km1p4ublc
TLSH
T13592495E621F2683D22613F8E02647DEE9B0AECFC304C7DD56465E2B06CB265D4A81FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 3ed5bf880d51061489be60217c011243f90deba3f4f1db9d3b4ecf7294d54a47
MD5 5585fc55cd9abfad6e4a8354fedc6f51
SHA1 5bc1cc51b8a40d7278a9fe469bcb690e2447d867
SHA512 2c0de926879edef15988743a3691f4cb77fee67f3e07e6861e1572b8bec7503eae28d740536c8afc40f8ffbc3c13cc83cb718d5a7c1798d32975544d3eb5298e
SSDEEP 384:56+BHRBDWOIppvFHdo9oVPARNYFFjffema7/ZKaMl7L1Prq+nFbOuj3luYUOg:Y0w3+oVPARN8FjffY73U31D4ubls
TLSH
T15992185D621F3A96E06613F8D02747DBFDB09DCFC3040BED26956E3B06CA27584990E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b8e953645da236d886c96f80cc0e88e339aecd741b69f0bf8e975ffe63f87a85
MD5 e73de4e56993f2b62722fbcd09d0eadd
SHA1 6c233d59c8265a0090128f19225f509c2596c0f0
SHA512 8c0617fafd6872e93e1e194f2b9b5e74e11e4f4978833d89353b798dc4af81388546b04f3e1869262804292013b30a0d12b4bdc1c8779e1c10e30c78d67ee8d3
SSDEEP 384:26+BHW5yBxkQfXu7FNCRK6bYFFNpfNaUOMck+1Ytdy1Ex+nFbOuj3lusOg:TbABxDuRNCRN8FNpfYxVUo1z4ublj
TLSH
T1EF921759222F2697E17623F8943607EBFEB09DCFC34007DD27482A2B169677188E55F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 45404dc14fcdcb62316d4c875fbedc2cd643efe03866592e39560a0de745f031
MD5 f93bd88d33f2b92b55ffa436bb6c34a9
SHA1 7dc9673bbd0f77f86d81baf7f81c26beb8699922
SHA512 4a5a6acbc47e3db0d4c64a92d4ab232718dd122e91cb6640d5c25457a34c500b04a94afe12687fad060e3c401c9f3952e74375756a17c90ef29457fe8e8e1481
SSDEEP 384:6sf+BG9RBQ5cyL2agBLOzJk3YFFNpfNiUOsckT1Ydok61b+nFbOuj3lu3cOg:HfRQ5eBOe38FNpfwpUkM1a4ublT
TLSH
T1C592085D222F26ABD0A623F8C43747EBED609DDFD34407DE1788592706CA6B588E41F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 38cad815c1c5393a933e7b3b588c38769ad4e4dbb30040df4212eb58e670c7a3
MD5 37aaf21d90ac5465497154839a36e177
SHA1 09a2e4e80c8b039f41d5b6e5d4e0dcaad1053e1c
SHA512 34e3e009e2f95b9d27f183ed0f1c0311f735d74753a51663f4491f79a2c6941fe30c385fe9ddd5474e4368e27eee90de4389389efcf874e0c383d4df3d410ffb
SSDEEP 384:K6+BHRBFX6PIy2gLAuoEk+o9++LOFNpfem1w7/IOTeaMldd1RjaR+nFbOuj3luYU:X0FXOIn3tnj++LOFNpf879dUj1R54ubC
TLSH
T16992195D622F2AD7C0A513F8D42A47DFE5B08DCFC3000BDD6688593B06DA76684BD6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 70c2b0d18cba74a7687e3934c7d13fa29a6981333cc420ec81075f1b4ce6330c
MD5 3223788af2e7e21a1235688fdf963ada
SHA1 8a4e76a36ad094b3197343e04027049a32f3b34e
SHA512 fb8bcde0c15733ad1f0ce223a9d952c5237c713808cfcb9c9e04a7a8ad8ffd22c848bdd0fa25ef9df7db130eb04b76edbafe71a16938606b9ef2a8d8d3cea129
SSDEEP 384:Ki+Bh9m+vw9ORIBkizJk+o9o2TJK6seYbneW8v/ZNwM0tOKEIjaipqZbObTUS22:X/ORsTejo2TJN+nsvYOKEI54qMB2
TLSH
T19D92D65E601F16C3C4861378E11B055FE8F2DE8D531A07D8BB2E9F3B8AACA9E413D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.1MB
SHA256 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303
MD5 a49b82957f9728361ef050399b1201e1
SHA1 fb8fadf9edf93404cf5296e021788fe0319b3f51
SHA512 2c054945c291cc3a9d2e0fa8f2d4aa0d0faf8164e1b227c7831e0e7d733ec2bd40989618706041b1a797aa7250781b93026fd1ebbbd14c3d6adbb37b1ac60b56
SSDEEP 98304:39Zizxyr+yMV/mMXcm0UGc/CU5/uqvcHXM/fnEtY7OVaXxdW4cFpabf:NgAMoM+E7x/EVaXxdWZLy
TLSH
T1661633517150FCB1E3D653312D54E1A01919BC916F63C2BBA9236E3BFE743A3CA50BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-156-0x0000000070D00000-0x0000000071054000-memory.dmp

Download

memory/612-164-0x0000000005A30000-0x0000000005A44000-memory.dmp

Download

memory/612-155-0x0000000070450000-0x000000007049C000-memory.dmp

Download

memory/700-258-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/1492-244-0x0000000006420000-0x0000000006434000-memory.dmp

Download

memory/1492-243-0x00000000063E0000-0x00000000063F1000-memory.dmp

Download

memory/1492-242-0x0000000007BE0000-0x0000000007C83000-memory.dmp

Download

memory/1492-234-0x0000000070CD0000-0x0000000071024000-memory.dmp

Download

memory/1492-232-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/1532-75-0x0000000005D60000-0x00000000060B4000-memory.dmp

Download

memory/1532-84-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/1532-85-0x0000000070CD0000-0x0000000071024000-memory.dmp

Download

memory/1748-103-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/1748-104-0x0000000070CF0000-0x0000000071044000-memory.dmp

Download

memory/2000-269-0x0000000070CD0000-0x0000000071024000-memory.dmp

Download

memory/2000-268-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/2524-185-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3136-39-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

Download

memory/3136-6-0x0000000005E50000-0x0000000005E72000-memory.dmp

Download

memory/3136-3-0x00000000030A0000-0x00000000030B0000-memory.dmp

Download

memory/3136-4-0x0000000003100000-0x0000000003136000-memory.dmp

Download

memory/3136-5-0x00000000057E0000-0x0000000005E08000-memory.dmp

Download

memory/3136-7-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/3136-8-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/3136-16-0x0000000006090000-0x00000000063E4000-memory.dmp

Download

memory/3136-17-0x00000000066E0000-0x00000000066FE000-memory.dmp

Download

memory/3136-18-0x0000000006720000-0x000000000676C000-memory.dmp

Download

memory/3136-45-0x0000000007E60000-0x0000000007E68000-memory.dmp

Download

memory/3136-44-0x0000000007E70000-0x0000000007E8A000-memory.dmp

Download

memory/3136-43-0x0000000007E20000-0x0000000007E34000-memory.dmp

Download

memory/3136-42-0x0000000007E00000-0x0000000007E0E000-memory.dmp

Download

memory/3136-41-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

Download

memory/3136-40-0x0000000007EC0000-0x0000000007F56000-memory.dmp

Download

memory/3136-19-0x0000000006C50000-0x0000000006C94000-memory.dmp

Download

memory/3136-20-0x0000000007A10000-0x0000000007A86000-memory.dmp

Download

memory/3136-38-0x0000000007CC0000-0x0000000007D63000-memory.dmp

Download

memory/3136-37-0x0000000007CA0000-0x0000000007CBE000-memory.dmp

Download

memory/3136-21-0x0000000008110000-0x000000000878A000-memory.dmp

Download

memory/3136-22-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Download

memory/3136-32-0x00000000030A0000-0x00000000030B0000-memory.dmp

Download

memory/3136-23-0x000000007F290000-0x000000007F2A0000-memory.dmp

Download

memory/3136-33-0x00000000030A0000-0x00000000030B0000-memory.dmp

Download

memory/3136-24-0x0000000007C60000-0x0000000007C92000-memory.dmp

Download

memory/3136-25-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/3136-26-0x00000000706D0000-0x0000000070A24000-memory.dmp

Download

memory/3136-34-0x00000000030A0000-0x00000000030B0000-memory.dmp

Download

memory/3576-278-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-283-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-288-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-293-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-298-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-303-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-308-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-313-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-318-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-328-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-195-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3576-323-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4004-207-0x0000000007C10000-0x0000000007C21000-memory.dmp

Download

memory/4004-198-0x0000000070CD0000-0x0000000071024000-memory.dmp

Download

memory/4004-208-0x00000000064B0000-0x00000000064C4000-memory.dmp

Download

memory/4004-197-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/4004-206-0x00000000078F0000-0x0000000007993000-memory.dmp

Download

memory/4056-175-0x0000000070D00000-0x0000000071054000-memory.dmp

Download

memory/4056-174-0x0000000070450000-0x000000007049C000-memory.dmp

Download

memory/4228-246-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/4228-247-0x0000000070CD0000-0x0000000071024000-memory.dmp

Download

memory/4232-129-0x0000000005A90000-0x0000000005DE4000-memory.dmp

Download

memory/4232-142-0x0000000070D00000-0x0000000071054000-memory.dmp

Download

memory/4232-150-0x0000000007220000-0x00000000072C3000-memory.dmp

Download

memory/4232-131-0x0000000006520000-0x000000000656C000-memory.dmp

Download

memory/4232-152-0x00000000059E0000-0x00000000059F1000-memory.dmp

Download

memory/4232-141-0x0000000070450000-0x000000007049C000-memory.dmp

Download

memory/4232-153-0x0000000005A30000-0x0000000005A44000-memory.dmp

Download

memory/4256-280-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4408-69-0x0000000007530000-0x00000000075D3000-memory.dmp

Download

memory/4408-71-0x0000000007870000-0x0000000007884000-memory.dmp

Download

memory/4408-70-0x0000000007820000-0x0000000007831000-memory.dmp

Download

memory/4408-56-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

Download

memory/4408-61-0x0000000070CF0000-0x0000000071044000-memory.dmp

Download

memory/4408-60-0x0000000070550000-0x000000007059C000-memory.dmp

Download

memory/4412-257-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4660-48-0x0000000004CC0000-0x00000000050BB000-memory.dmp

Download

memory/4660-59-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4660-49-0x00000000050C0000-0x00000000059AB000-memory.dmp

Download

memory/4660-2-0x00000000050C0000-0x00000000059AB000-memory.dmp

Download

memory/4660-1-0x0000000004CC0000-0x00000000050BB000-memory.dmp

Download

memory/4968-102-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4968-117-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download