glupteba | 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpz72uqk35.exe
Size 9.1MB
Sample260522-1jdl6shw9s
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002454f-110.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1720	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4008	csrss.exe
4344	csrss.exe
4064	csrss.exe
1332	csrss.exe
4276	csrss.exe
3064	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpz72uqk35.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpz72uqk35.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpz72uqk35.exe
File created	C:\Windows\rss\csrss.exe	tmpz72uqk35.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1208	powershell.exe
4464	powershell.exe
944	powershell.exe
4204	powershell.exe
2596	powershell.exe
4728	powershell.exe
2240	powershell.exe
2872	powershell.exe
4504	powershell.exe
4280	powershell.exe
4428	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2696	schtasks.exe
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	powershell.exe
1208	powershell.exe
2780	tmpz72uqk35.exe
2780	tmpz72uqk35.exe
4728	powershell.exe
4728	powershell.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
4220	tmpz72uqk35.exe
2240	powershell.exe
2240	powershell.exe
2872	powershell.exe
2872	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe
4344	csrss.exe
4344	csrss.exe
4280	powershell.exe
4280	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
944	powershell.exe
944	powershell.exe
4204	powershell.exe
4204	powershell.exe
944	powershell.exe
4204	powershell.exe
1332	csrss.exe
1332	csrss.exe
2596	powershell.exe
2596	powershell.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
4008	csrss.exe
4008	csrss.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe
4008	csrss.exe
4008	csrss.exe
3064	injector.exe
3064	injector.exe
3064	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2780	tmpz72uqk35.exe
Token: SeImpersonatePrivilege	2780	tmpz72uqk35.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4344	csrss.exe
Token: SeImpersonatePrivilege	4344	csrss.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	1332	csrss.exe
Token: SeImpersonatePrivilege	1332	csrss.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeSystemEnvironmentPrivilege	4008	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1208	2780	tmpz72uqk35.exe	90
PID 4220 wrote to memory of 4728	4220	tmpz72uqk35.exe	98
PID 4220 wrote to memory of 4684	4220	tmpz72uqk35.exe	100
PID 4684 wrote to memory of 1720	4684	cmd.exe	102
PID 4220 wrote to memory of 2240	4220	tmpz72uqk35.exe	103
PID 4220 wrote to memory of 2872	4220	tmpz72uqk35.exe	105
PID 4220 wrote to memory of 4008	4220	tmpz72uqk35.exe	107
PID 4008 wrote to memory of 4504	4008	csrss.exe	110
PID 4344 wrote to memory of 4464	4344	csrss.exe	112
PID 4008 wrote to memory of 4280	4008	csrss.exe	118
PID 4064 wrote to memory of 4428	4064	csrss.exe	121
PID 1332 wrote to memory of 944	1332	csrss.exe	131
PID 4008 wrote to memory of 4204	4008	csrss.exe	133
PID 4276 wrote to memory of 2596	4276	csrss.exe	136
PID 4008 wrote to memory of 3064	4008	csrss.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
"C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1720
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4504
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2696
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2808
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3064
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4132

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4428

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 8341375685b4e36b0cb56da77bcd6b5f2550a66e1eaeeb3f3c5748e39b00abdb
MD5 d93208a7e87806f1c24e1f017cef5247
SHA1 e2e9b5e9334ad3122b8483d63356428a68fedd78
SHA512 e402842a7a7a945e04193985b8db17f87d655376107725c6a3e76a3f6ab2c76527a30a49b06b27610f66b6903519316fd812e69d7306a65500743c12f08da5dd
SSDEEP 384:1sf+hoO9i+mlbL4faBZb2wk4o9o2T9K6seYbneKx/xoXLYbLU0uF5Lt9KuA/9JfH:qfAWlbsizbeto2T9N+nVAY/XcLt9OXOY
TLSH
T10FA2E75E618F1AC3C4865378D10A041FE8F29D8D431926D8BB1F8F7B8A6C6BF6078148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 e856b2f8a05bd24006ba14b8ac94cd5eaa703e551a45da603a2205637d49929f
MD5 b5ad420118f35c4b1a61a3224bceb3eb
SHA1 677d5eb03532b60d9e42ae4a28d7e7af90830306
SHA512 a51e03b8727c5c42afd5ccab248464295f7a2f93db3a0aa6e8ffcb5a5d411ce8fccbb32beacaa63605a7af7916e43d475d80cb0dcb8ec2168dacdb93b6667bcf
SSDEEP 384:g6+hoB991TIu4jAa4Qvboo2NYFFNpfNzP/xUvsX0goUIrJek5LWKWSB9x+n2JBLW:BAITpjSaN8FNpf1PukmU0EGK/CL9o
TLSH
T131A2395A625F2AD7D09923B4C42643DFE5B08CCEC3401BCDB74A5A3B07CAA7564F85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jknawoyj.5aw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jknawoyj.5aw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ad7cae2b22044282733b722d8d763d92c4c7ea5697bfa3ad872637ed44f667c5
MD5 8b231377a114a9f35f775225b79141c1
SHA1 214b0f4217e81d309c0d9d39db1da8fa6b3d36ba
SHA512 ccfae20f1142887b7094801f92f733fad0c5630a54f1c77e89d6babef9f252f384caedfd0e44bdaf0f018cdf24015c47debfb4322cbd3b338c0e9612485d1bec
SSDEEP 384:26+BZ9m+TuDfGzo8jVFkJfnRo9o5ATBNYFFNpfempw7/IOAcmaMRJ21RQ+nFbOu1:TYJTynCo5ATBN8FNpfg7ZVII1Rl4ublz
TLSH
T1C792295D622F2997C0A513F4E42643EBD8B0ADCFC38007DD5B4A2E3B02CA275D4A81EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5579821e7f57971cf992e965e4b04e4ffcdf6bb523bd9fd4986a275c6e74c710
MD5 2baf84d4461c8645ae6b0cf1c2884b0a
SHA1 764ae5d8484eac931420f6a599d23d22895a48ff
SHA512 ddd24e0b8e727751c7f8cf4e4e9070d80e47b70ca28aa78a1be1c980b50f3cb3c102b94403ae3c7251894334bb5b1b6782ea234ef77e03f6e9a88d03ae9c1c4a
SSDEEP 384:glsf+BB9RBBY5+6kt222HqJk+o9oNTVNYFTpfem1g/IORw0oIdd1Eo+nFbOuj3lT:g6fEBYP2kvjoNTVN8Tpfctj1a4ublT
TLSH
T11C92195D221F3AD7C0A613F8C42A07EBD9B08DCFC30407DE56875E3716CA6B594A81E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8e59134a26ecd496a9e1698cb85e4b1dc5c10d7f14c2519ee0b16e8fe26da7e2
MD5 aa466cb2ca161e0be77a1d865018630c
SHA1 e7a4fb541963a4cdced0a3b60865c0fae45c611a
SHA512 e92d0e808e01528572159c7d712c9036e98e1f3a66b09a0ce25639d9a031f7b00116584745f674813800a9c7f6b47f13c39261ac27329203bc9516ccda3fc5c2
SSDEEP 384:Isf+BHRByVLyBieUwYmTNNYFFNpfem1c7/IOKPMloIy1Pr/+nFbOuj3lusOg:Ff0y1yo5wRRN8FNpfY7SUo1a4ublj
TLSH
T13392299E622F2AD7D0A513F8C43A43DFE9B08DCFC30407DE56886D3B06CA76654995E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e18b88ddd6d90c121091734cf58aa5778e8222c47258986d046471dc1a9f58f2
MD5 1c28d406105e0c856403c160848e35a9
SHA1 1fc4d5ca47da4acd639fd49065d08305fc599147
SHA512 77cd7a97949b838c2f7c0fcfe16a5efd7aba4e2e45f81ea3169d9e2979265a0c2b83a638bc9dce2550dc97ff7fbb0ad97c5d6ef7f5f659ef0bcc62f8396563fe
SSDEEP 384:A86+BHRBKjAYaFfsYizJkyto9o2T9NYFFNpfNxgUOEcmaMhd81NW+nFbOuj3lutZ:A9EK03snejo2T9N8FNpfAZVYm1t4ubl4
TLSH
T1C1922A5E222F3A97C0B623F8C42647EBD9709DCFC3040BDE568A693706CA77544A95F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d41513b58e19aa6f8764218bb8d21e41bbd2ac21846c1828bf17d8d6a12ba96d
MD5 d7250a577515c14cec267e0ed4f690e6
SHA1 592e1eb03f195441b905df270b8c69ad7a6be3c9
SHA512 ce2f10f7b7a170e2215585e9d89cfd30eb31ab039878a263d9e75f7d005b297e6644a8cf7de9a320347eba50ee92555f0de6c33b6de5a3f172fa2865cd84c91f
SSDEEP 384:psf+BB9m+h0jdvBi3uk+o9owTVK6seYbneS8v/ZRwMHlOiEIjaLMZbObTUSKd:efQ0dodjowTVN+nIvtOiEI/qMdd
TLSH
T16F92E75E211F16C3C4861378E11B045FE8F2EE8D531A13D8BB5E9F3B8AACA9E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 18873639b930be4086947411204ca0f3a4d021459c5f7ee2dd50e3b9b7e7ff56
MD5 dfd1e93829f8ff417c9784d61e968205
SHA1 580219d3cd97412dd37f5275694e0677b6926328
SHA512 8a409a04e63857e0404cf96ba88933e4de78de12668ce39d0d1dfa67c412f71a0c7f7d69bef9c56b44bc37a3d331b6d765442a89d8807d80557ff8f17fde6e16
SSDEEP 384:E8sf+BHRBda+IaPJBiZU8bo4ADNYFFjZpfem1g7/IOKPMlda1EY+nFbOuj3luJOg:E5fEM+5RoZU4ADN8FjZpf87SU41a4ubm
TLSH
T1BC92175D621F2AD3E0A113F4C42A47EBF9B09DCFC38006DD57892E3B06DA77584A91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-214-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/944-213-0x0000000071150000-0x000000007119C000-memory.dmp

Download

memory/1208-37-0x0000000007380000-0x000000000738A000-memory.dmp

Download

memory/1208-15-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Download

memory/1208-21-0x000000007FC30000-0x000000007FC40000-memory.dmp

Download

memory/1208-22-0x0000000007240000-0x0000000007272000-memory.dmp

Download

memory/1208-23-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

Download

memory/1208-24-0x0000000071200000-0x0000000071554000-memory.dmp

Download

memory/1208-34-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/1208-33-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/1208-32-0x0000000007280000-0x000000000729E000-memory.dmp

Download

memory/1208-36-0x00000000072A0000-0x0000000007343000-memory.dmp

Download

memory/1208-35-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/1208-19-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Download

memory/1208-38-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Download

memory/1208-39-0x00000000073A0000-0x00000000073B1000-memory.dmp

Download

memory/1208-40-0x00000000073E0000-0x00000000073EE000-memory.dmp

Download

memory/1208-41-0x00000000073F0000-0x0000000007404000-memory.dmp

Download

memory/1208-42-0x0000000007430000-0x000000000744A000-memory.dmp

Download

memory/1208-43-0x0000000007420000-0x0000000007428000-memory.dmp

Download

memory/1208-0-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/1208-1-0x00000000026F0000-0x0000000002726000-memory.dmp

Download

memory/1208-2-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/1208-3-0x0000000004F50000-0x0000000005578000-memory.dmp

Download

memory/1208-18-0x0000000006DD0000-0x0000000006E46000-memory.dmp

Download

memory/1208-4-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

Download

memory/1208-5-0x0000000004D70000-0x0000000004DD6000-memory.dmp

Download

memory/1208-17-0x0000000006210000-0x0000000006254000-memory.dmp

Download

memory/1208-6-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/1208-16-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Download

memory/1208-20-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Download

memory/1208-14-0x0000000005670000-0x00000000059C4000-memory.dmp

Download

memory/2240-80-0x0000000070FC0000-0x0000000071314000-memory.dmp

Download

memory/2240-79-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Download

memory/2240-77-0x0000000006330000-0x0000000006684000-memory.dmp

Download

memory/2596-245-0x0000000070970000-0x00000000709BC000-memory.dmp

Download

memory/2596-254-0x0000000007BB0000-0x0000000007C53000-memory.dmp

Download

memory/2596-244-0x00000000069A0000-0x00000000069EC000-memory.dmp

Download

memory/2596-246-0x0000000070F20000-0x0000000071274000-memory.dmp

Download

memory/2596-242-0x00000000062D0000-0x0000000006624000-memory.dmp

Download

memory/2596-260-0x0000000007ED0000-0x0000000007EE1000-memory.dmp

Download

memory/2596-261-0x0000000006760000-0x0000000006774000-memory.dmp

Download

memory/2872-99-0x0000000070D60000-0x00000000710B4000-memory.dmp

Download

memory/2872-98-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Download

memory/2872-96-0x00000000056D0000-0x0000000005A24000-memory.dmp

Download

memory/4204-223-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/4204-222-0x0000000071150000-0x000000007119C000-memory.dmp

Download

memory/4280-181-0x0000000007A20000-0x0000000007AC3000-memory.dmp

Download

memory/4280-173-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/4280-183-0x0000000007DB0000-0x0000000007DC1000-memory.dmp

Download

memory/4280-184-0x00000000065E0000-0x00000000065F4000-memory.dmp

Download

memory/4280-164-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/4280-172-0x0000000071150000-0x000000007119C000-memory.dmp

Download

memory/4428-185-0x0000000071150000-0x000000007119C000-memory.dmp

Download

memory/4428-186-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/4428-210-0x0000000006340000-0x0000000006354000-memory.dmp

Download

memory/4464-144-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/4464-143-0x0000000070B40000-0x0000000070B8C000-memory.dmp

Download

memory/4504-142-0x0000000007B80000-0x0000000007B91000-memory.dmp

Download

memory/4504-141-0x0000000007800000-0x00000000078A3000-memory.dmp

Download

memory/4504-133-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/4504-123-0x0000000006B00000-0x0000000006B4C000-memory.dmp

Download

memory/4504-113-0x0000000005F80000-0x00000000062D4000-memory.dmp

Download

memory/4504-132-0x0000000070B40000-0x0000000070B8C000-memory.dmp

Download

memory/4504-152-0x00000000057C0000-0x00000000057D4000-memory.dmp

Download

memory/4728-55-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Download

memory/4728-54-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Download

memory/4728-53-0x00000000057A0000-0x0000000005AF4000-memory.dmp

Download

memory/4728-56-0x0000000071370000-0x00000000716C4000-memory.dmp

Download

memory/4728-64-0x0000000006FE0000-0x0000000007083000-memory.dmp

Download

memory/4728-65-0x00000000072F0000-0x0000000007301000-memory.dmp

Download

memory/4728-66-0x0000000007340000-0x0000000007354000-memory.dmp

Download