glupteba | 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303

Analysis

max time kernel
27s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpnpubrevm.exe
Size 4.1MB
Sample260602-mg2dkacs6p
SHA256 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303
MD5 a49b82957f9728361ef050399b1201e1
SHA1 fb8fadf9edf93404cf5296e021788fe0319b3f51
SHA512 2c054945c291cc3a9d2e0fa8f2d4aa0d0faf8164e1b227c7831e0e7d733ec2bd40989618706041b1a797aa7250781b93026fd1ebbbd14c3d6adbb37b1ac60b56
SSDEEP 98304:39Zizxyr+yMV/mMXcm0UGc/CU5/uqvcHXM/fnEtY7OVaXxdW4cFpabf:NgAMoM+E7x/EVaXxdWZLy
TLSH
T1661633517150FCB1E3D653312D54E1A01919BC916F63C2BBA9236E3BFE743A3CA50BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 22 IoCs

resource	yara_rule
behavioral3/memory/2360-2-0x00000000050D0000-0x00000000059BB000-memory.dmp	family_glupteba
behavioral3/memory/2360-48-0x00000000050D0000-0x00000000059BB000-memory.dmp	family_glupteba
behavioral3/memory/2360-47-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/352-97-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/352-196-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-213-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/4560-225-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/1432-229-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3508-245-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-246-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/2144-248-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/2144-263-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-265-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-270-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-275-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-280-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-285-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-290-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-295-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-300-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-305-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba
behavioral3/memory/3772-310-0x0000000000400000-0x0000000002F2E000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1056	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
3772	csrss.exe
4560	csrss.exe
1432	csrss.exe
3508	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpnpubrevm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpnpubrevm.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpnpubrevm.exe
File created	C:\Windows\rss\csrss.exe	tmpnpubrevm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
500	powershell.exe
2220	powershell.exe
4536	powershell.exe
1044	powershell.exe
2388	powershell.exe
4864	powershell.exe
1904	powershell.exe
4376	powershell.exe
4808	powershell.exe
4660	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpnpubrevm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpnpubrevm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4792	schtasks.exe
2044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4864	powershell.exe
4864	powershell.exe
2360	tmpnpubrevm.exe
2360	tmpnpubrevm.exe
1904	powershell.exe
1904	powershell.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
352	tmpnpubrevm.exe
4376	powershell.exe
4376	powershell.exe
4808	powershell.exe
4808	powershell.exe
4660	powershell.exe
4660	powershell.exe
4552	powershell.exe
4552	powershell.exe
4536	powershell.exe
4560	csrss.exe
4560	csrss.exe
4536	powershell.exe
500	powershell.exe
500	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	2360	tmpnpubrevm.exe
Token: SeImpersonatePrivilege	2360	tmpnpubrevm.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4560	csrss.exe
Token: SeImpersonatePrivilege	4560	csrss.exe
Token: SeDebugPrivilege	500	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4864	2360	tmpnpubrevm.exe	84
PID 352 wrote to memory of 1904	352	tmpnpubrevm.exe	89
PID 352 wrote to memory of 5108	352	tmpnpubrevm.exe	91
PID 5108 wrote to memory of 1056	5108	cmd.exe	93
PID 352 wrote to memory of 4376	352	tmpnpubrevm.exe	94
PID 352 wrote to memory of 4808	352	tmpnpubrevm.exe	96
PID 352 wrote to memory of 3772	352	tmpnpubrevm.exe	98
PID 3772 wrote to memory of 4660	3772	csrss.exe	101
PID 4560 wrote to memory of 4552	4560	csrss.exe	103
PID 3772 wrote to memory of 4536	3772	csrss.exe	109
PID 1432 wrote to memory of 500	1432	csrss.exe	120
PID 3508 wrote to memory of 2220	3508	csrss.exe	122
PID 3772 wrote to memory of 1044	3772	csrss.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe
"C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpnpubrevm.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4792
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4536
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:3164
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2044

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:500

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 d345bc87a3abdfd86d33d83048352482b759ec1042519d6a8e78b36ca3a83eaa
MD5 541417237a815519c691740d882ffa53
SHA1 4d116da31828a89c3f9851d957e9093c03a612b2
SHA512 8f5f2a5b0fa2b0416a6b23c6930eea90f228ffb55dc0d9fa70b2b78e26f495fbab338f5a57d933cdb0f77fb889eae4420c827ed5d38dcd92ecf76efea39e18cb
SSDEEP 384:YL3HhweSS1v7FP1H55vLHFRHEMEeHnnNvjQGIq1Lj5bsUjuNoyEIDbiJ0LOj9tFK:+xDSSV7FF51lRPE+NvjfIq1L9bxuN/9f
TLSH
T15892D5AE711F26C3C89563B8D10A040FE8F2DE8D031A56DDB72E8F7B89AC95E417D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 9c0640d03de9874ca95ee3fc76842c162fdcf073eb98cfa479b80372dc65e04e
MD5 115875bf3b6d4e4d348bc6c19dde40f1
SHA1 40932c6e18470e7ea46305c50478a86e369b4ea9
SHA512 6ebe9c39e1768ea648c7b45194c64c71f00686b7b5ce92357848bd4264346e6e3ec501d8189bbd0db95777a2a9d2056a14b705653db32951b3004c03697b099e
SSDEEP 384:9THhwz1SGnSCsRa+XeHTzHtjWaK2jw7GmeVdq4Gexy8iWxLnnY9phAUd5H:fISxCsR+TpjWaBEC5Vw8NiWlY9p2UT
TLSH
T1C5921A59622F2ADBD8A923F8C422039FE5F18EDEC34097CD6359583B05CE66054BD6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1z1rva0k.yad.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1z1rva0k.yad.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d0891eed147d145dd7122f9c406cb1de4fd2bfa56e1697c098be18e4f46ae495
MD5 a360e4f5b0b6a2642eaeafce23600eb6
SHA1 b5c1680e72938da72610083884b9fcd93a0474d0
SHA512 300888763a1ab1e8af410326335b664d65423420f8c20524e655648f699fa6d98d73f9a9c092fda173f9014c17c3e8dcb6f9d24afce2ddce92146ad22ae7b427
SSDEEP 384:YTHhm61S2XSm9FRHEMEz6ggZconNvjF1ICKLNXcHbX2b/nY9jhUdoH:PuSBmbRPEzqamvjF1ICKLNMbGbA9lUA
TLSH
T10092176D626F26DBC4A813B8C026078BE9B19EDE4304D7DE670A5D3B05CB276806D5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6a0b6bdc1f3d4e429cd0f7ca6f7d26900c2a3ed648dd83f1340ed91a9a866483
MD5 c5770e3e0a99c44c162297219ced3ac0
SHA1 2e22040873711e05676a01c323063ed5e19d5765
SHA512 4f8523295ff64fecb7c7ef213250bd3b2f5cd846c3e4717e7cce44db92db38c1538feb7e6cbc8272fb63ff52d83ddc76ee35a91af91e94b6ef4ab6f939a13c21
SSDEEP 384:8THhwSStkjuzNsIvFRE5ncAHtjWaK2QkbHbIMz/nY9jhUd9H:bSS2o9RanrjWaBQibnzA9lUr
TLSH
T1DD92296D222F26DBC4A523F8C02247CFE9B18ECE834093DE6359593B49CF66144AD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5bc2a26664746343f700756c329d72df6890bacb54a37c892f11da70ec83c901
MD5 f5ce8cd2775bda779d3e62723befe0e1
SHA1 c2766f4ee6e063f580df0b5b200e77cf0231f177
SHA512 86967a09d329a26f87111cb160251f8cbe54ac877aa4249fac2fdb6bd86a8f5341fd25174dc23a1c509a8ab73dc5e1fa053d8ee009852a5dd4ca9d4bb1ec2667
SSDEEP 384:lTHhwSSJ0H9p5Tj6FRHEME3eHnnNjjWaK2mLNXqMHm7LmL7nY9jhUdwH:gSSGJP6RPEuNjjWaBmLNYCLk9lUc
TLSH
T10492296D222F269BE4A613F8902707DBFDA09DCFC30053DE56196D3B05CB67188A85ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 f74fd86d221f63c387301c90f15ec2e5eae5a6d53b3b1ba9536209b52dd83b6d
MD5 5519d1fe6fd19efa466d48619a93a492
SHA1 084140227880e226c4763e01a58a7ef3ff48373e
SHA512 822ff514f7c49fd18b3be5154386284f360849ac23a117d1b287a1116015340a3ad368489c4f9101c112b62708ae6a2a7e5790125349f20149b85d07691dcd1d
SSDEEP 384:ZL3HhlSSJUjV1oFRHEMESHHJjQr2wkjMHmH0fKDQSanY9jhUdkH:hbSS2Z1QRPESpjvwUDQO9lU0
TLSH
T10492286D222F3647C46962F4D432579BEEA09ECF4384D2DE5708983B05CB67088E95FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 67460af1739e7c6f10c252078c28f61ad41ffd020c008c027763f62861834757
MD5 1bd1566e0b822c0b14f7bd1d26760432
SHA1 67d57012bd7ebedb62e74199e9cd196144823e5b
SHA512 7f6bdbb41384e21f2afc13de2474083d94fc995cfdb9858323af407ae871c7ec87f1740350d8196597e2353f29b342f74748be3ac3ad6fd2c9cd760626838296
SSDEEP 384:GL3HhwSSJcxyUnuyxSvEiHnnNzjQGII+NXjg2xZb3XfHzkRjNadF+:wKSSOxyYZOJNzjfII+NzgCZb3/zkKdk
TLSH
T15492C5AE611F22C3C88553B8D10A050FE8F2DF8D031913D8BB2E9F7B89AC55E917D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 268ae0093d65309f7d0d1250c788e0f2621b07d478704600418a1e21ee87a91d
MD5 32204855138e938befb5fa8b00b57754
SHA1 3c3dd7ef284e5b37aa5fea222d7f4466ad75af1a
SHA512 99656a028e0851f46fa833864be8af7ccea13a4308657f979cfd3c66334d96d46765e09f9cba5829f2aceacea2e6e13110c94e755d3262a50f05f2d3857c28a4
SSDEEP 384:GL3HhtiStwSNPLFRHEME/Th6HPQczN7jFK2OLNXjg4bWzynY9jhUdEH:wriS3NPpRPE/VKPrx7jFBOLNzPbWzd9z
TLSH
T1EC9249AE225F26DBD4A523F8C0220797E9F09ECE834453DE575B6D3B05CE67190A84EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.1MB
SHA256 27f43c0cba4d8813a3c93021f76938916e4556a0c0806e48f4574a412df5c303
MD5 a49b82957f9728361ef050399b1201e1
SHA1 fb8fadf9edf93404cf5296e021788fe0319b3f51
SHA512 2c054945c291cc3a9d2e0fa8f2d4aa0d0faf8164e1b227c7831e0e7d733ec2bd40989618706041b1a797aa7250781b93026fd1ebbbd14c3d6adbb37b1ac60b56
SSDEEP 98304:39Zizxyr+yMV/mMXcm0UGc/CU5/uqvcHXM/fnEtY7OVaXxdW4cFpabf:NgAMoM+E7x/EVaXxdWZLy
TLSH
T1661633517150FCB1E3D653312D54E1A01919BC916F63C2BBA9236E3BFE743A3CA50BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-196-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/352-97-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/500-187-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/500-188-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/500-211-0x0000000006430000-0x0000000006445000-memory.dmp

Download

memory/1044-216-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/1044-215-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/1432-229-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/1904-66-0x00000000075A0000-0x0000000007644000-memory.dmp

Download

memory/1904-68-0x0000000007940000-0x0000000007955000-memory.dmp

Download

memory/1904-67-0x00000000078F0000-0x0000000007901000-memory.dmp

Download

memory/1904-50-0x0000000005E20000-0x0000000006177000-memory.dmp

Download

memory/1904-58-0x0000000070690000-0x00000000706DC000-memory.dmp

Download

memory/1904-59-0x00000000708E0000-0x0000000070C37000-memory.dmp

Download

memory/1904-57-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/2144-248-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/2144-263-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/2220-198-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/2220-197-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/2360-2-0x00000000050D0000-0x00000000059BB000-memory.dmp

Download

memory/2360-48-0x00000000050D0000-0x00000000059BB000-memory.dmp

Download

memory/2360-47-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/2360-1-0x0000000004CD0000-0x00000000050CE000-memory.dmp

Download

memory/2360-46-0x0000000004CD0000-0x00000000050CE000-memory.dmp

Download

memory/2388-261-0x0000000005B20000-0x0000000005B35000-memory.dmp

Download

memory/2388-240-0x0000000005D60000-0x00000000060B7000-memory.dmp

Download

memory/2388-243-0x0000000006300000-0x000000000634C000-memory.dmp

Download

memory/2388-251-0x00000000705F0000-0x000000007063C000-memory.dmp

Download

memory/2388-252-0x0000000070770000-0x0000000070AC7000-memory.dmp

Download

memory/2388-259-0x00000000074F0000-0x0000000007594000-memory.dmp

Download

memory/2388-260-0x0000000007880000-0x0000000007891000-memory.dmp

Download

memory/3508-245-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-295-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-280-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-213-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-270-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-265-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-275-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-315-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-310-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-285-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-290-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-246-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-300-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/3772-305-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4376-80-0x0000000070690000-0x00000000706DC000-memory.dmp

Download

memory/4376-78-0x0000000006250000-0x00000000065A7000-memory.dmp

Download

memory/4376-81-0x0000000070810000-0x0000000070B67000-memory.dmp

Download

memory/4536-171-0x0000000007610000-0x00000000076B4000-memory.dmp

Download

memory/4536-173-0x0000000005DD0000-0x0000000005DE5000-memory.dmp

Download

memory/4536-163-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/4536-164-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/4552-142-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/4552-151-0x0000000005960000-0x0000000005975000-memory.dmp

Download

memory/4552-141-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/4560-225-0x0000000000400000-0x0000000002F2E000-memory.dmp

Download

memory/4660-120-0x0000000006030000-0x0000000006387000-memory.dmp

Download

memory/4660-140-0x0000000007AB0000-0x0000000007AC1000-memory.dmp

Download

memory/4660-132-0x0000000070590000-0x00000000708E7000-memory.dmp

Download

memory/4660-123-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/4660-131-0x0000000070B70000-0x0000000070BBC000-memory.dmp

Download

memory/4660-149-0x0000000005F90000-0x0000000005FA5000-memory.dmp

Download

memory/4660-139-0x0000000007730000-0x00000000077D4000-memory.dmp

Download

memory/4808-98-0x0000000070690000-0x00000000706DC000-memory.dmp

Download

memory/4808-99-0x00000000708A0000-0x0000000070BF7000-memory.dmp

Download

memory/4808-94-0x00000000063F0000-0x0000000006747000-memory.dmp

Download

memory/4864-7-0x0000000004F10000-0x0000000004F32000-memory.dmp

Download

memory/4864-8-0x0000000005610000-0x0000000005676000-memory.dmp

Download

memory/4864-32-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4864-5-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4864-3-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4864-30-0x0000000007190000-0x00000000071AE000-memory.dmp

Download

memory/4864-6-0x0000000004F70000-0x000000000559A000-memory.dmp

Download

memory/4864-33-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4864-17-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Download

memory/4864-36-0x00000000072E0000-0x00000000072FA000-memory.dmp

Download

memory/4864-18-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Download

memory/4864-34-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4864-35-0x0000000007920000-0x0000000007F9A000-memory.dmp

Download

memory/4864-19-0x0000000006210000-0x0000000006256000-memory.dmp

Download

memory/4864-20-0x000000007F340000-0x000000007F350000-memory.dmp

Download

memory/4864-4-0x0000000002800000-0x0000000002836000-memory.dmp

Download

memory/4864-9-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/4864-31-0x00000000071B0000-0x0000000007254000-memory.dmp

Download

memory/4864-21-0x0000000007150000-0x0000000007184000-memory.dmp

Download

memory/4864-16-0x0000000005770000-0x0000000005AC7000-memory.dmp

Download

memory/4864-22-0x0000000070580000-0x00000000705CC000-memory.dmp

Download

memory/4864-23-0x0000000070790000-0x0000000070AE7000-memory.dmp

Download

memory/4864-37-0x0000000007320000-0x000000000732A000-memory.dmp

Download

memory/4864-38-0x0000000007430000-0x00000000074C6000-memory.dmp

Download

memory/4864-39-0x0000000007340000-0x0000000007351000-memory.dmp

Download

memory/4864-40-0x0000000007390000-0x000000000739E000-memory.dmp

Download

memory/4864-41-0x00000000073A0000-0x00000000073B5000-memory.dmp

Download

memory/4864-42-0x00000000073F0000-0x000000000740A000-memory.dmp

Download

memory/4864-43-0x0000000007410000-0x0000000007418000-memory.dmp

Download