glupteba | ded8b2fd7871bfdde3ebc26b9f38068ff1a468d7789e3a7b522d42dbda6e971e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpycfygk05.exe
Size 9.1MB
Sample260522-1d2rtahw5v
SHA256 ded8b2fd7871bfdde3ebc26b9f38068ff1a468d7789e3a7b522d42dbda6e971e
MD5 677be40e8299ce0685ab5e0367e0523f
SHA1 3a803a6de62649f9ffde6054c0b36cf8ca89fbad
SHA512 881d399243935ab02658b2687423473dc9f40fc2d49ba4b467ea0760dcbe9efd79c0b47a2a0900c457dae3582ba229c59ddd7aaff2e809ec199a4486f472a187
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iq9:sxEvYjVzANwhwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00030000000228c6-109.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4512	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
888	csrss.exe
3924	csrss.exe
2900	csrss.exe
4076	csrss.exe
4600	csrss.exe
3132	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpycfygk05.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpycfygk05.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	tmpycfygk05.exe
File opened for modification	C:\Windows\rss	tmpycfygk05.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4836	powershell.exe
4408	powershell.exe
1088	powershell.exe
4152	powershell.exe
4440	powershell.exe
5100	powershell.exe
2428	powershell.exe
1360	powershell.exe
4716	powershell.exe
3544	powershell.exe
2984	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpycfygk05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpycfygk05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2980	schtasks.exe
820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
868	tmpycfygk05.exe
868	tmpycfygk05.exe
4408	powershell.exe
4408	powershell.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
3352	tmpycfygk05.exe
1088	powershell.exe
1088	powershell.exe
4152	powershell.exe
4152	powershell.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
3924	csrss.exe
3924	csrss.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
4076	csrss.exe
4076	csrss.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
888	csrss.exe
888	csrss.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe
888	csrss.exe
888	csrss.exe
3132	injector.exe
3132	injector.exe
3132	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	868	tmpycfygk05.exe
Token: SeImpersonatePrivilege	868	tmpycfygk05.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	3924	csrss.exe
Token: SeImpersonatePrivilege	3924	csrss.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	4076	csrss.exe
Token: SeImpersonatePrivilege	4076	csrss.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeSystemEnvironmentPrivilege	888	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4836	868	tmpycfygk05.exe	89
PID 3352 wrote to memory of 4408	3352	tmpycfygk05.exe	95
PID 3352 wrote to memory of 3104	3352	tmpycfygk05.exe	97
PID 3104 wrote to memory of 4512	3104	cmd.exe	99
PID 3352 wrote to memory of 1088	3352	tmpycfygk05.exe	100
PID 3352 wrote to memory of 4152	3352	tmpycfygk05.exe	102
PID 3352 wrote to memory of 888	3352	tmpycfygk05.exe	106
PID 888 wrote to memory of 2428	888	csrss.exe	108
PID 3924 wrote to memory of 1360	3924	csrss.exe	111
PID 888 wrote to memory of 4716	888	csrss.exe	140
PID 2900 wrote to memory of 4440	2900	csrss.exe	128
PID 4076 wrote to memory of 5100	4076	csrss.exe	130
PID 888 wrote to memory of 3544	888	csrss.exe	132
PID 4600 wrote to memory of 2984	4600	csrss.exe	135
PID 888 wrote to memory of 3132	888	csrss.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpycfygk05.exe
"C:\Users\Admin\AppData\Local\Temp\tmpycfygk05.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\tmpycfygk05.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpycfygk05.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2428
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2980
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3132
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:820

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2984

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ddd0f8bdc1fa35d640c423e07d7cbca8 nUzHdlfPFEqKhdnzZAi00g.0.1.0.0.0
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 c580066a21400e0d4e1caa900111c87a5cc635b37aacc322e8425e9aec1f4ffa
MD5 3491d60ed586d5125181d0476b278473
SHA1 ae5c3f2adecd07f2386e552ae64aaa35d4b44d8a
SHA512 dccd87eb96023a6230acc2b41e3823750bbd281e38a6082c42f711419ab4e2185ad2f217f613fd1f6933bcd81487a349ce00d17f6db6c98b39f79d323639f0ff
SSDEEP 384:3sf+hoh9i+pKddmhri3FZkEo9o2T9K6seYbneKx/xoXLYbLU0aF5Lt9KuA/9JfAu:cfA2K+m1Spo2T9N+nVAY/XALt9OXOK0M
TLSH
T16BA2E75E618F1AC3C4865378D10A041FE8F2DD8D431926D8BB1F8F7B8AAC6BF6178148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 46e627bd5be20115c81f298813be57cc63611ca8e6a245f72e984c4c504ab829
MD5 b0d532017e9b70a60fa447e6f6ca6792
SHA1 6d8ba3e8e4946d516219f0c5cb0050b79073a7de
SHA512 bf491eceb628539e407d88c17848a8cf6afe98acd4fd61ad18bee322a565e32fec7140d7415fe48d2071256d8eaf1c4173a7cfd3491d4ea0798311d0e008d300
SSDEEP 384:BF6+hoH91m5tTUzVNpR5QSNYFFNpfNlx/xUDsXc/OoUIrJekhLWKW0h9Vx9d+n2F:2AImHilN8FNpfFuwWU0EOKKmCLFD
TLSH
T150A2075AA21F2AD7E45613B9C426479FE0F0DDCEC3000ACD7785993716CAA7660FC6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1yrof0pr.uaw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1yrof0pr.uaw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8865e1fd351732e078f09d60c8a3698b95074a84a25fce49f597db6cf1a05e10
MD5 5c409361e6279832136c77949b249221
SHA1 e288d7e6ca6dee3df3786d0a5c5dc73afded7561
SHA512 1bc57ddd9742a5b8f0e91951659c980d0c8964945cccfdb89d877faa9e17207824bdf523f63e09bfa7d9b826abf6f0b65f283b50862f0014b07a7b62545597df
SSDEEP 384:esf+Bi9RBBsPSuZ1F3xxHGQQ1NYFFNpfemdw7/ZqPM1dm1zwU+nFbOuj3luYcOg:LflBs6O7zHGQQ1N8FNpfc7ak01a4ublk
TLSH
T1B592195D221F3AE7C0A523F4C42747EBD9B09CCF830007DD578A6A3B06CA77694A84E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6c6f1e8e560a4581219980db4beb69368c278c38ad2832e943975a02daab6961
MD5 29e07917191edc855b216e939550b82f
SHA1 97eb869a3d5d2e45edc80c8388d01031bca2b6bd
SHA512 b7e155af07ac98d0ffe40817b77ca131e4f11d3ae976d44ec3d8d29dd9f306c04cf7072fb86c5024193cc0c2551e8e6d54af6065901d63743c626ac20e367db7
SSDEEP 384:A6+BnRBACBLXfQBtNho9oAKYYFFjffem27/IOEcmaMhooN1m+nFbOuj3lf0Og:hUAW4XNSoAN8Fjff87NVYv1z4ubls
TLSH
T19892085D622F3A9AE06113F8A43A47DFF9B0ADCFC300069D5A581D3B05DA37684A91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 dda61a956fb28bd37537eab677e62d8acd87ad11146f2a05cf602e40cc566f06
MD5 fb60b835de463afd261cc377127fc6e4
SHA1 5f788230191e9f3523fde2bdb3f8300821af77d3
SHA512 16ccc5a8cce087b8db90145bf21f296d028f8a04036b6ab3d92257a5ada526d5d3e59f4a3daf74ee38ad262e202d82704d7529a0821ce31da8a9af163ebecd08
SSDEEP 384:Tsf+BS9RBGQKh+qPSbidwdo9otNYPNpfemxw7/Zq01okhE1RjaLM+nFbOuj3lf3U:ofNGQRcieotNiNpfw71PE1Rs4ubls
TLSH
T1EA92275D221F2697E0A513F4D42643DFE4F0AECFC34446DD67889E2B06DB66A84EC1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 4996cd4a179cdaff71df3c92cac81fe2395b302564ade289046e071466f2fa08
MD5 3adcacc7a326179384ebcfe3ec8711c4
SHA1 b8f8bc673065f90cd8fd2e4c21e6b52eeafbfb06
SHA512 065c3bd5a6d54b23b9953a1ebd01d46c32321b10b202525bcff151fdc6874a9a7945b5a5ce3dacc658b795cd41d2ae70facdf36e55d69d5432c7d8e09491ea65
SSDEEP 384:w8sf+BHRB6bFBocTTlzJkEo9o58NYFFNpfNxw7/IOJwPMhok813ja8+nFbOuj3lA:w5fE6bjBYpo58N8FNpfQ7qYS13g4ublA
TLSH
T1BD92199E620F2AD7D06613B4C42A47DFE5B09DCE938007DD63856A3B06CE76590EC6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5519ef01dae299ccdbbcb1e80bc0cd70f6824235eaff00d8ac59ca0d18ae543b
MD5 9766687e04c32113f229c1c265f7c38b
SHA1 edcf8013f8f25de3a580e8973a40d561bc9abad9
SHA512 320711ed36e59f116d5f139b69fe6bcfb3c58543e63f316f2f8804544be56f7d4e5ca398bdc4dd09c5e0e49c5d3e569a7f74ead6f7e285524588940fa391f86f
SSDEEP 384:d6+Bm9m+2moX8BBizJRCi9o7eSTpK6seYbnea8v/ZxwM01O2EIjai0PZbObTUSi2:cGmUIojNo9TpN+nov8O2EIEBqMN2
TLSH
T1D592E65E211F16C3C4861378E117055FE8F1EE8D531A17D8BB1E9F3B8AACA9E813D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 27f9f0e5e89225d33d15acfc8ca986f5561f4df36789928a47218cc63d33a964
MD5 22421dc5bcb57180aafe36dd8a241503
SHA1 6074e9a3e46b148a6aff995185c40c0c4d03bc0f
SHA512 e371a0b1a3c674a2c28c67c5bbe9b60a69e49d4f76ac636066994d5d2b9fb5c02fec952e4d8315ba8861c5a731147b37c1107d87ad74044b3fff3d7daa301498
SSDEEP 384:p6+Bm9RBYqCSC33zqWiyto9C9A1NYFFjffemdc7/IOscmtMM1dm1EZ+nFbOuj3lk:oJYqGgjC9A1N8Fjff47dKMkU1j4ublk
TLSH
T17092275D622F1A97E36613F8C42A4B9FF8B09CCFC30006DD56815E390ADA7B594E85F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 ded8b2fd7871bfdde3ebc26b9f38068ff1a468d7789e3a7b522d42dbda6e971e
MD5 677be40e8299ce0685ab5e0367e0523f
SHA1 3a803a6de62649f9ffde6054c0b36cf8ca89fbad
SHA512 881d399243935ab02658b2687423473dc9f40fc2d49ba4b467ea0760dcbe9efd79c0b47a2a0900c457dae3582ba229c59ddd7aaff2e809ec199a4486f472a187
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iq9:sxEvYjVzANwhwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-79-0x0000000070670000-0x00000000709C4000-memory.dmp

Download

memory/1088-78-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/1360-142-0x0000000071C20000-0x0000000071C6C000-memory.dmp

Download

memory/1360-143-0x0000000070400000-0x0000000070754000-memory.dmp

Download

memory/2428-141-0x0000000005CB0000-0x0000000005CC1000-memory.dmp

Download

memory/2428-151-0x0000000005CF0000-0x0000000005D04000-memory.dmp

Download

memory/2428-121-0x00000000067E0000-0x000000000682C000-memory.dmp

Download

memory/2428-119-0x0000000005DC0000-0x0000000006114000-memory.dmp

Download

memory/2428-132-0x0000000070400000-0x0000000070754000-memory.dmp

Download

memory/2428-140-0x00000000074C0000-0x0000000007563000-memory.dmp

Download

memory/2428-131-0x0000000071C20000-0x0000000071C6C000-memory.dmp

Download

memory/2984-252-0x0000000070440000-0x000000007048C000-memory.dmp

Download

memory/2984-261-0x00000000071B0000-0x0000000007253000-memory.dmp

Download

memory/2984-253-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/2984-246-0x0000000005FE0000-0x000000000602C000-memory.dmp

Download

memory/2984-262-0x00000000074E0000-0x00000000074F1000-memory.dmp

Download

memory/2984-263-0x0000000005D80000-0x0000000005D94000-memory.dmp

Download

memory/3544-224-0x0000000070280000-0x00000000702CC000-memory.dmp

Download

memory/3544-235-0x00000000062C0000-0x00000000062D4000-memory.dmp

Download

memory/3544-225-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/4152-97-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/4152-98-0x0000000070C80000-0x0000000070FD4000-memory.dmp

Download

memory/4152-88-0x0000000005820000-0x0000000005B74000-memory.dmp

Download

memory/4408-54-0x00000000066D0000-0x000000000671C000-memory.dmp

Download

memory/4408-55-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/4408-56-0x0000000070670000-0x00000000709C4000-memory.dmp

Download

memory/4408-64-0x00000000073B0000-0x0000000007453000-memory.dmp

Download

memory/4408-65-0x00000000076D0000-0x00000000076E1000-memory.dmp

Download

memory/4408-66-0x0000000007720000-0x0000000007734000-memory.dmp

Download

memory/4408-53-0x0000000005C60000-0x0000000005FB4000-memory.dmp

Download

memory/4440-195-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/4440-214-0x0000000005A10000-0x0000000005A24000-memory.dmp

Download

memory/4440-211-0x00000000059D0000-0x00000000059E1000-memory.dmp

Download

memory/4440-203-0x00000000072A0000-0x0000000007343000-memory.dmp

Download

memory/4440-194-0x0000000070280000-0x00000000702CC000-memory.dmp

Download

memory/4716-166-0x0000000070280000-0x00000000702CC000-memory.dmp

Download

memory/4716-155-0x0000000005D10000-0x0000000006064000-memory.dmp

Download

memory/4716-191-0x00000000062A0000-0x00000000062B4000-memory.dmp

Download

memory/4716-183-0x0000000007A50000-0x0000000007A61000-memory.dmp

Download

memory/4716-175-0x00000000076E0000-0x0000000007783000-memory.dmp

Download

memory/4716-167-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/4716-164-0x0000000006630000-0x000000000667C000-memory.dmp

Download

memory/4836-33-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4836-22-0x0000000007CE0000-0x0000000007D12000-memory.dmp

Download

memory/4836-36-0x0000000007D40000-0x0000000007DE3000-memory.dmp

Download

memory/4836-23-0x00000000703F0000-0x000000007043C000-memory.dmp

Download

memory/4836-37-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Download

memory/4836-30-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4836-38-0x0000000007F40000-0x0000000007FD6000-memory.dmp

Download

memory/4836-39-0x0000000007E40000-0x0000000007E51000-memory.dmp

Download

memory/4836-0-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4836-40-0x0000000007E80000-0x0000000007E8E000-memory.dmp

Download

memory/4836-41-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

Download

memory/4836-42-0x0000000007EE0000-0x0000000007EFA000-memory.dmp

Download

memory/4836-43-0x0000000007ED0000-0x0000000007ED8000-memory.dmp

Download

memory/4836-34-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4836-24-0x00000000709A0000-0x0000000070CF4000-memory.dmp

Download

memory/4836-35-0x0000000007D20000-0x0000000007D3E000-memory.dmp

Download

memory/4836-21-0x000000007FD50000-0x000000007FD60000-memory.dmp

Download

memory/4836-20-0x0000000007B30000-0x0000000007B4A000-memory.dmp

Download

memory/4836-1-0x00000000051B0000-0x00000000051E6000-memory.dmp

Download

memory/4836-2-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4836-19-0x0000000008190000-0x000000000880A000-memory.dmp

Download

memory/4836-18-0x0000000007A90000-0x0000000007B06000-memory.dmp

Download

memory/4836-17-0x0000000006CB0000-0x0000000006CF4000-memory.dmp

Download

memory/4836-16-0x00000000067A0000-0x00000000067EC000-memory.dmp

Download

memory/4836-15-0x0000000006760000-0x000000000677E000-memory.dmp

Download

memory/4836-14-0x0000000006120000-0x0000000006474000-memory.dmp

Download

memory/4836-6-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/4836-5-0x0000000005FC0000-0x0000000006026000-memory.dmp

Download

memory/4836-4-0x0000000005790000-0x00000000057B2000-memory.dmp

Download

memory/4836-3-0x0000000005820000-0x0000000005E48000-memory.dmp

Download

memory/5100-215-0x0000000070AF0000-0x0000000070E44000-memory.dmp

Download

memory/5100-213-0x0000000070280000-0x00000000702CC000-memory.dmp

Download