glupteba | 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpz72uqk35.exe
Size 9.1MB
Sample260522-1jdl6shw9s
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001900000002b525-100.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4020	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2124	csrss.exe
964	csrss.exe
4424	csrss.exe
2060	csrss.exe
3092	csrss.exe
2888	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpz72uqk35.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpz72uqk35.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpz72uqk35.exe
File created	C:\Windows\rss\csrss.exe	tmpz72uqk35.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5084	powershell.exe
1968	powershell.exe
3704	powershell.exe
2344	powershell.exe
5112	powershell.exe
2100	powershell.exe
2216	powershell.exe
3204	powershell.exe
2996	powershell.exe
3260	powershell.exe
1920	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3200	schtasks.exe
1372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
2880	tmpz72uqk35.exe
2880	tmpz72uqk35.exe
3204	powershell.exe
3204	powershell.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2740	tmpz72uqk35.exe
2996	powershell.exe
2996	powershell.exe
3260	powershell.exe
3260	powershell.exe
1920	powershell.exe
1920	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
964	csrss.exe
964	csrss.exe
2100	powershell.exe
2100	powershell.exe
2100	powershell.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
4424	csrss.exe
4424	csrss.exe
2216	powershell.exe
2216	powershell.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2124	csrss.exe
2124	csrss.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2888	injector.exe
2124	csrss.exe
2124	csrss.exe
2888	injector.exe
2888	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	2880	tmpz72uqk35.exe
Token: SeImpersonatePrivilege	2880	tmpz72uqk35.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	964	csrss.exe
Token: SeImpersonatePrivilege	964	csrss.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	4424	csrss.exe
Token: SeImpersonatePrivilege	4424	csrss.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeSystemEnvironmentPrivilege	2124	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 5112	2880	tmpz72uqk35.exe	85
PID 2740 wrote to memory of 3204	2740	tmpz72uqk35.exe	90
PID 2740 wrote to memory of 3716	2740	tmpz72uqk35.exe	92
PID 3716 wrote to memory of 4020	3716	cmd.exe	94
PID 2740 wrote to memory of 2996	2740	tmpz72uqk35.exe	95
PID 2740 wrote to memory of 3260	2740	tmpz72uqk35.exe	97
PID 2740 wrote to memory of 2124	2740	tmpz72uqk35.exe	99
PID 2124 wrote to memory of 1920	2124	csrss.exe	100
PID 964 wrote to memory of 5084	964	csrss.exe	104
PID 2124 wrote to memory of 1968	2124	csrss.exe	110
PID 4424 wrote to memory of 2100	4424	csrss.exe	120
PID 2060 wrote to memory of 3704	2060	csrss.exe	123
PID 2124 wrote to memory of 2344	2124	csrss.exe	125
PID 3092 wrote to memory of 2216	3092	csrss.exe	128
PID 2124 wrote to memory of 2888	2124	csrss.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
"C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1920
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3200
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3616
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2888
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1372

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3704

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 ee9cef34f8df5161374e5059bc333d3c4c3aa27e5d288de61d1f7f94628cdbe0
MD5 a661667168dfdc579a8c655532f00990
SHA1 46bb48e0ee83d0fdcd08ee46a46c8dabe9f11395
SHA512 d62346a695b46703509ed4ac521f0d52493a466c5f69e09cab42366a889a6be598a42301f48c0ad7d038811f579a8048e835231ce11405bb3067c4d0cac2a9ed
SSDEEP 384:RL3HhwyiS1JXM1V0GoRznN/jQGIC1Lj5vsUjYNuyEIDXiJwLOj9WCFy:ZxXiSA1V2Rx/jfIC1L9vxYN99DXimLnz
TLSH
T1D092D69E715F16C3C88563B8D106040FE8F2DECD031A56D8BB2E8F7B89AC99E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 3441806c7f22e9c02e72db7db1ffc3902ed0d1b70d821fa9f3bbbf4ffa4f78cd
MD5 cb5c0548f9a2db58522e697c2de5b3be
SHA1 f30efa2e971fc654c647bba39e0ccb0924747e55
SHA512 9bdbad207a765fbace673a5139de52b21b24210a2a3f386a3a002726980eb918a6ecc42e32da4d9d2d8d8b3c68cec6a47be21b8225ec92c8f5e376efd966c445
SSDEEP 384:UXTHhwz1ZASpwdGRXcwjKeHnxCaK2EK2G5Vdq4Gep0WxLnnY9phAUd5H:6IZAS2IRswJxCaBEKZ5VwjWlY9p2UT
TLSH
T1B6923969221F2AD7E4AA23B8C02703CFF9F48DDEC30417DE630D693B058A66554A95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1uvtpl0f.wgt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uvtpl0f.wgt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 72e071e78fca25470253a53697c6baf115b4a0121bcd760200dcbee482ce3794
MD5 e9668deb771aeba20e5f0f5de67f2901
SHA1 7495b58614813abf56fd6f021faf22e42847c2d2
SHA512 5b6e75ce4f025acdfeff5fe59952c20718714872120590e3bb01238728f325ad49d25791cf17bb1aa001c8486d73b5081942641453fba4fed71c586f114b1479
SSDEEP 384:bTHhwSStrBGh0RHEz5NW7jnNvjWa1ICaLNXyqkHbWz/nY9jhUd9H:6SSTG6RIoBvjWa1ICaLNbEbWzA9lUr
TLSH
T17592186D226F2697C4E923F8C022039FE9B09EDF430457DE671A6D3B05CE27194694ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 81a692fdb5881323187cf096f9b8b8698731367e32065a84e3930718cca51501
MD5 6cf819de185663df8106e493b10fc0aa
SHA1 c2ac16013a9f66dabc4b7fe4ad7b133950654f3c
SHA512 313369c809813922bebd2321aee311bbc45d76e7b1d4eaeb9865727e52a42c0fc7e926cee75721f2135ac13d9d8dcd2ec87801f04d5718d89484b55a33f351f1
SSDEEP 384:AL3HhwSStvei82FRGXsPrHnHtjfIC4Neog5Uq4bX0I6iSnY9jhUdhH:mKSSdj82RKsTNjfIC4NLg5UZbv6i99lq
TLSH
T14C9228A9222F2697D85513F8E026079FF9F0AECF834457ED67189C3B05CE261C4A94EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 47ee80f010894bd022344733f2e0e665046622e3414b241888068105b6bc5e78
MD5 60cb67661650d5b2ce2dc5b95a067f34
SHA1 61ed103e940b8943b057d353afc13a5c756841d4
SHA512 1c7227e804033ba5f7d092e966194c8023ef0bef206c2793d97cfa4fc9f64a91c7ffbb492c27c5cb2d0b33b374711476714260b55186221c3cc74cb6def39790
SSDEEP 384:ZTHhz1S2kjHzT9UBzFRHEMEH3eHNtvCa1k2ANX7dHmHGEfq6ivnY9jhUdkH:NS3z6fRPEODvCa13AN0a6iw9lUw
TLSH
T17C92185D226F36DAE4A523F8D02617C7FAB08DCEC38493DE5356983B05CB66084AD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 0cc3616e219892027a26e3734b64d1ee5c0851462f196f4f9bc571dfc6f1f71a
MD5 4af18b6dd651ed90a7a542f0e4b1edcc
SHA1 bc38c919299cf53e859e861f9bf663fe3dad2c67
SHA512 097bee8db6553f4ddc2c38b9ba2a8a325c327326dbbfa9857dec4320fbde5dc857d0bb9b0b362dff7a09c3aa602f2ac04fdfcb91d91876c7b07d9e1557cc23d9
SSDEEP 384:5PHhz1S2kgLtckpFRnyTr1wH4czHBjWaK2CkHGtsqibnY9jhUdkH:JS3QtceRKr1MTNjWaBXXqiE9lU0
TLSH
T1D392295D222F269BD4A923F9C02313DBEEF08ECE838053DE6749583F05CA67194995EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 724B
SHA256 35b93b8bda13722018d6e4895b3db6a9d3bd09eacb52b721da0a15875ab28f0a
MD5 14fd7d9b09cebbed2f5e4dcc56f25fe4
SHA1 9a2467a535e4ff73116dfc2adc6fd204316472db
SHA512 6b30ac0dc7a109430c3bd41b19457347aff47f918088075f4f58b190154378329f4d181cc7464c1745bbea675e055f5f0a464e68b3cb8c1850b7fa6b222fa3d0
TLSH
T186014422F34DD039C895127A2889AA123A3583C74186DE8B3684C128EA57846CB783A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 bca84a54821e059b8a72dc956475ee7045521ca401d56b793ddcd27fb78bfca6
MD5 5f5e73e23be73b7d13559ffec1e954d9
SHA1 a4f6a8368cedaf3ea34fe642bbcbd4e89637f1f0
SHA512 0c851111e23661fb06dfb42c12d9d194e8c25d75c848d43677893c53690afb7eb9057e2a9fb932380daaf9cbcec1231acd965e3613ba91cf0d6e7349b2ff7126
SSDEEP 384:XTHht+SJw2FRLeoEMNHEPe/NzjQGIHs+NXjg2R+bfzTzpRjNHdFa:v+SbFRL3BEUzjfIHs+NzgK+bfvzpXdc
TLSH
T16C92D6AE615F12C3C8C553B8D10B010FE8F2DE8D431A52D9BB2E9F7B89AC59E913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5b8a1072b0e8397c066d5089c6f193508b8198a77d07e8f226fca1d3a6b5647b
MD5 b570beb6f78883563905dc1c6804545b
SHA1 c755cdc1e226116c6319524ed6c2fed08ca37484
SHA512 9153c9b6f5d18c832f91f8f349aa187701ac18487db3588aaacebb5a035a2ad109c18f4aa59f286c59ef200b298025c021b0f08978c61885208487abb6fde9a3
SSDEEP 384:CL3Hhpi2bOkUwlFRvmTI7NjWaK3LNeoigqo7SzynY9jhUdkH:MfiHbwTR+CjWagLNL5NWzd9lU0
TLSH
T11D9217A9222F269BD49613F4A0260B9FFDF09ECF834413DE63055D3B05CA275C4A85ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1920-127-0x0000000007E00000-0x0000000007E11000-memory.dmp

Download

memory/1920-129-0x00000000061B0000-0x00000000061C5000-memory.dmp

Download

memory/1920-107-0x00000000063E0000-0x0000000006737000-memory.dmp

Download

memory/1920-110-0x00000000068B0000-0x00000000068FC000-memory.dmp

Download

memory/1920-112-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/1920-113-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/1920-120-0x0000000007A60000-0x0000000007B04000-memory.dmp

Download

memory/1968-158-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/1968-168-0x0000000005610000-0x0000000005621000-memory.dmp

Download

memory/1968-167-0x0000000006F30000-0x0000000006FD4000-memory.dmp

Download

memory/1968-159-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/1968-169-0x0000000005AD0000-0x0000000005AE5000-memory.dmp

Download

memory/2100-176-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/2100-177-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/2216-220-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/2216-221-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/2216-228-0x00000000077C0000-0x00000000077D1000-memory.dmp

Download

memory/2216-234-0x0000000005C70000-0x0000000005C85000-memory.dmp

Download

memory/2344-211-0x0000000005F20000-0x0000000005F35000-memory.dmp

Download

memory/2344-200-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/2344-201-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/2996-72-0x0000000070C10000-0x0000000070F67000-memory.dmp

Download

memory/2996-71-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/3204-48-0x0000000005620000-0x0000000005977000-memory.dmp

Download

memory/3204-59-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

Download

memory/3204-60-0x0000000006FF0000-0x0000000007005000-memory.dmp

Download

memory/3204-58-0x0000000006C90000-0x0000000006D34000-memory.dmp

Download

memory/3204-51-0x0000000070C10000-0x0000000070F67000-memory.dmp

Download

memory/3204-50-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/3204-49-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Download

memory/3260-86-0x0000000005660000-0x00000000059B7000-memory.dmp

Download

memory/3260-88-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/3260-89-0x0000000070C30000-0x0000000070F87000-memory.dmp

Download

memory/3704-185-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/3704-186-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/5084-131-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Download

memory/5084-148-0x0000000005B50000-0x0000000005B65000-memory.dmp

Download

memory/5084-140-0x0000000007380000-0x0000000007391000-memory.dmp

Download

memory/5084-132-0x0000000070B70000-0x0000000070EC7000-memory.dmp

Download

memory/5084-139-0x00000000071B0000-0x0000000007254000-memory.dmp

Download

memory/5112-27-0x00000000053E0000-0x00000000053F0000-memory.dmp

Download

memory/5112-19-0x0000000070B90000-0x0000000070EE7000-memory.dmp

Download

memory/5112-34-0x0000000007D90000-0x0000000007E26000-memory.dmp

Download

memory/5112-35-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

Download

memory/5112-36-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

Download

memory/5112-31-0x0000000008280000-0x00000000088FA000-memory.dmp

Download

memory/5112-37-0x0000000007D00000-0x0000000007D15000-memory.dmp

Download

memory/5112-32-0x0000000007C40000-0x0000000007C5A000-memory.dmp

Download

memory/5112-30-0x0000000007B10000-0x0000000007BB4000-memory.dmp

Download

memory/5112-29-0x0000000007AF0000-0x0000000007B0E000-memory.dmp

Download

memory/5112-39-0x0000000007D70000-0x0000000007D78000-memory.dmp

Download

memory/5112-28-0x00000000053E0000-0x00000000053F0000-memory.dmp

Download

memory/5112-26-0x00000000053E0000-0x00000000053F0000-memory.dmp

Download

memory/5112-33-0x0000000007C80000-0x0000000007C8A000-memory.dmp

Download

memory/5112-18-0x0000000070980000-0x00000000709CC000-memory.dmp

Download

memory/5112-0-0x00000000053E0000-0x00000000053F0000-memory.dmp

Download

memory/5112-38-0x0000000007D50000-0x0000000007D6A000-memory.dmp

Download

memory/5112-17-0x0000000007AB0000-0x0000000007AE4000-memory.dmp

Download

memory/5112-16-0x000000007F1F0000-0x000000007F200000-memory.dmp

Download

memory/5112-15-0x0000000006BE0000-0x0000000006C26000-memory.dmp

Download

memory/5112-14-0x0000000006720000-0x000000000676C000-memory.dmp

Download

memory/5112-13-0x0000000006690000-0x00000000066AE000-memory.dmp

Download

memory/5112-12-0x0000000006170000-0x00000000064C7000-memory.dmp

Download

memory/5112-5-0x00000000060C0000-0x0000000006126000-memory.dmp

Download

memory/5112-4-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/5112-3-0x00000000058C0000-0x00000000058E2000-memory.dmp

Download

memory/5112-2-0x0000000005A20000-0x000000000604A000-memory.dmp

Download

memory/5112-1-0x0000000005230000-0x0000000005266000-memory.dmp

Download