glupteba | 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpgc5pndng.exe
Size 9.1MB
Sample260602-lsla2sat6v
SHA256 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89
MD5 d45b8f133e6629d1cfb5471810138e47
SHA1 ae3b70e7b61d0506a6fc94a9e2767faa41e37e8a
SHA512 d38af500cc9402b06571bbde0dd8a8bec0c17787c875ccfd5b34c2909425ce270a5dcc017e4ef728578a4979bf3601e502d271522ee7cee278dd13b93875a1b0
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfShZytTD5iqr:sxEvYjVzANqhwN
TLSH
T191A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000024681-109.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
740	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4480	csrss.exe
1692	csrss.exe
3732	csrss.exe
3012	csrss.exe
5104	csrss.exe
1416	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpgc5pndng.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpgc5pndng.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpgc5pndng.exe
File created	C:\Windows\rss\csrss.exe	tmpgc5pndng.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe
820	powershell.exe
892	powershell.exe
4204	powershell.exe
4124	powershell.exe
732	powershell.exe
3464	powershell.exe
3052	powershell.exe
2424	powershell.exe
2228	powershell.exe
4324	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgc5pndng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgc5pndng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe
4968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
732	powershell.exe
732	powershell.exe
1332	tmpgc5pndng.exe
1332	tmpgc5pndng.exe
892	powershell.exe
892	powershell.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
1804	tmpgc5pndng.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
4124	powershell.exe
4124	powershell.exe
1692	csrss.exe
1692	csrss.exe
4124	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
3012	csrss.exe
3012	csrss.exe
820	powershell.exe
820	powershell.exe
820	powershell.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
4480	csrss.exe
4480	csrss.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
1416	injector.exe
4480	csrss.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	1332	tmpgc5pndng.exe
Token: SeImpersonatePrivilege	1332	tmpgc5pndng.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1692	csrss.exe
Token: SeImpersonatePrivilege	1692	csrss.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	3012	csrss.exe
Token: SeImpersonatePrivilege	3012	csrss.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 732	1332	tmpgc5pndng.exe	89
PID 1804 wrote to memory of 892	1804	tmpgc5pndng.exe	96
PID 1804 wrote to memory of 1488	1804	tmpgc5pndng.exe	101
PID 1488 wrote to memory of 740	1488	cmd.exe	103
PID 1804 wrote to memory of 4204	1804	tmpgc5pndng.exe	104
PID 1804 wrote to memory of 3464	1804	tmpgc5pndng.exe	108
PID 1804 wrote to memory of 4480	1804	tmpgc5pndng.exe	110
PID 4480 wrote to memory of 3052	4480	csrss.exe	111
PID 1692 wrote to memory of 2424	1692	csrss.exe	115
PID 4480 wrote to memory of 4124	4480	csrss.exe	121
PID 3732 wrote to memory of 2228	3732	csrss.exe	132
PID 3012 wrote to memory of 4324	3012	csrss.exe	148
PID 4480 wrote to memory of 2772	4480	csrss.exe	136
PID 5104 wrote to memory of 820	5104	csrss.exe	139
PID 4480 wrote to memory of 1416	4480	csrss.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe
"C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1416
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4968

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2228

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:820

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv lVopIG5SQUGRio6hdLE9TA.0.2
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 28faa309da1bfb927a7d80a2080bdbbc2532f6277aee6513937f6e51e28db2b3
MD5 dc6c436f65404b305a022ad0312d7389
SHA1 27c59cbb92f12be557ae2578aa17128499e095c8
SHA512 b46365036da4c0152265fcca57afe763e13a7ffeff02c57bdd3ca41217f88e68e0e9650e6299f2f5894749c4b390d588bdce45d9f96ee2fc77b01655c2bdd617
SSDEEP 384:Wsf+hoG9i+ekejR0uAMzJkSo9owT5K6seYbneOx/xoDLYbLU0CF5ft9KOA/9J7Ai:zfAO9dFenowT5N+nxkY/Xoft9uTOKwM
TLSH
T183A2E65E618F16C3C4861378D10A041FE8F2DE8D431927D8BB1F8F7B8AAD6BE6179548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 1621ae7ba311ff484b298bcd852ec1e43d22706f24a2c4feb8bf5c8f0524dd51
MD5 a9bda71541707361ec5fc595f60df7ed
SHA1 793f6a3a87ab97e488a85fee3a1dd45eb8e78fe9
SHA512 8cbdd1c020176001ff192d6e8857b8fb04ea750aeab10a6bb6edc4831b65c5b771f7e63f28060af45923b60f87e918d454313629079f7e5cd0055dad82281fb7
SSDEEP 384:zsf+hoH91ukiIUOaGBazJkyo9dFNYFFNpfNlx/x9cFvsXcxq2UIKJek5KMWBspBd:IfA4u4AeHdFN8FNpfFUFkyUBEGKbyCLW
TLSH
T175A2285A624F2AD7C49923B8C43643DFD5B08DCF83005BCD674A993B46CEA7664F81E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lvzx3y0o.dca.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvzx3y0o.dca.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c030789ecc5916efed5a19f56fd21b5695257c30257588aac4f6655ebeba8ece
MD5 43ba1a4c7b830b8a2078c390b88b9046
SHA1 0e33ecb718a0f0e7e771edaa0eca5827f61bbcd1
SHA512 236d84fb1bc1b716cc574964f424a0b38694dbaadb0c14d60409350c8e9425077ddb03f92f1fb33476bc002e25e0182e9ee6fc97d272ac17b239c749596286d7
SSDEEP 384:i8sf+BB9RBcXpXj7Bvxz5o4QNYFFjffemRg7/IOutNMtom81RjxP+nFbOuj3luJl:i5fMc5XHjBQN8Fjffw7oNcM1R84ublI
TLSH
T1E692175E611F2AD7D06613F4C42A4BEBE9B0ADCEC38007DD67856E3706CA76540EC1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 832de6dc2f9faafb5c988a6540d34830903a66eaa300b366981b366d33a66b2a
MD5 ed8787accf540c29df73d481fce8ae9f
SHA1 d5dec93f0cf861c76f117c4f51410a39b8ff9217
SHA512 1ac517f2e13e7574c80606b7a6f5b7032b5fd35f98f728d55c490bfafb4b109369149fa763ed7690d7a0fbf50ef3a32b5016aef389946932d5d81cf862904e42
SSDEEP 384:1sf+BsRBwv/Les0BokblZoJYKYYFFNpfNxw7AOxw01oE11Prf+nFbOuj3luYsOg:qfNwv8dbnoJYN8FNpfw71b1q4ublU
TLSH
T1EC92195E621F3AE7C0A623F4C42643DFDAB08DCFC30407DE1689693B06DA7B554995E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 0bddc604c3828164850155680db462ff784fe0569d576237497a1369fdc98037
MD5 ad1e14be39afbc1602cbfc698f5420f6
SHA1 f7fe4195927d9423b9bb7fc28174dc89b8ccbdfe
SHA512 00e0128fd02ad807b5de8ed7223978f36b1bc2d3fc5034056306105a0ebcd694299f5088ff591e26f6ecc5d6a83aa18a92ad749ea26fa50ff385c84f8dd27b2b
SSDEEP 384:W8sf+BB9RBA5meBeJo+kGGo9o2RNYPNpfem1w7/IOTePMftda1RjaY+nFbOuj3lY:W5f0AfGKGLo2RNiNpf879cUw1R84ublY
TLSH
T1E192195D621F3A97C06513B8E42B47DBE970ADCF8304079D668A5E3707CA7B5C4AC2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 42ccc0f30dc4c82cd80006bd2ba60ac1ab6218e5f0c68f205f60280072eb5d19
MD5 11c9aba75e5793310cd8385991f42756
SHA1 817e78ed0243d2bc46eabe546cc56b3badb00312
SHA512 3e30fedeae7bc76b7b85cfd33155d85c9e1016bff7033ca5ff434d3ce42a15f5338facc03a620c226087178eeaa2daf2aca25f37e9706410b45be1b4f92bf680
SSDEEP 384:O6+BHRBw2p5C3BbxRzJkyto9o5ATVNYFFNpfem1wUOTeaMldz15q+nFbOuj3lu3c:LErpBjo5ATVN8FNpf8BdUt114ublT
TLSH
T1C992395D621F2A96E22613F4E02647EAF9B0AECFC340CADD47820D3606DB671C4D91F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1887a4b43c9d9eb00aef93a68b232f5c21b53cb0c067b74cf0dd0c78b666ce50
MD5 431e190946c3166f69d23ff25a234048
SHA1 309fbf22091fdfa1011b2b5a4d8b96952ffc531f
SHA512 87ac9202af2689653f97b8908b8c3071f167cc1605a1250a2ecd80cbf3601db2bc5f271bd524be46bef8924c60c35b51c79117478a228213f3bb4fac53b1a710
SSDEEP 384:TXsf+BmRBBUL7J7fOiNKNYFFjffemVwUObmPMuOxN1Rja4+nFbOuj3luJvOg:IfnKfbNKN8FjffkRUhOn1R84ublw
TLSH
T18392175E621F2A92E02213F8D42A4BDBF8B09DCFC3444ADD5B452E3706DF36584A91EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8e0cb3e8c09db39d17b558785d77176bdef1b34cfe64151f3353c8af41971dd5
MD5 0a1f69989ec04fdde24548e59c6d308f
SHA1 cd9af93bff615fc1aba175e6241ead36059b83b2
SHA512 df5d1f82650f341a4dd686762d17c19eeab130d67f1caf2ff77656e2086d154e3f935cb4ed4018da3d034751abd868e91247ee87d9ba3f0e9a94d4a9d60b5505
SSDEEP 384:psf+B99m+mPaLvWEBie24kTo9o2TVK6seYbneS8v/ZRwMHlOuEIjaLMZbObTUS/2:ef3GRoe+Eo2TVN+nIvtOuEI/qMs2
TLSH
T19492D75E611F16C3C48613B8D11B044FE8F1DE8D531A17D8AB1E9F3B8AACA9F913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e20ce914abe2c93193165d33bafccf68d57b60aef34ac0494d4b42f89ecd19ac
MD5 a3ab0ba3e6f605f796b1ca5c5d19dcc8
SHA1 7bf497ce809df3c17d9e8b0424be09f61d93d1b0
SHA512 09cb3128db5f05b2cc685bc2df019728a0d45cac1f8625e58fe34cc188ac440092cdfacacb5aee10f956800de157bcc71dc4bfae0c4cec6411b99f00d22f0253
SSDEEP 384:N8sf+BN9RBwXVEw5s5p7Q72NYPjffem1w7/IOAMlJy1b+nFbOuj3lulOg:N5fQwXy/Nijff87SUk1a4ubls
TLSH
T19792265D221F2A96E16213F4E02A47DBF8F0ADCFC34406ED57805E3A16DA67684E80F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89
MD5 d45b8f133e6629d1cfb5471810138e47
SHA1 ae3b70e7b61d0506a6fc94a9e2767faa41e37e8a
SHA512 d38af500cc9402b06571bbde0dd8a8bec0c17787c875ccfd5b34c2909425ce270a5dcc017e4ef728578a4979bf3601e502d271522ee7cee278dd13b93875a1b0
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfShZytTD5iqr:sxEvYjVzANqhwN
TLSH
T191A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/732-20-0x0000000007650000-0x000000000766A000-memory.dmp

Download

memory/732-43-0x00000000079E0000-0x00000000079E8000-memory.dmp

Download

memory/732-22-0x00000000077F0000-0x0000000007822000-memory.dmp

Download

memory/732-23-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

Download

memory/732-27-0x0000000002E00000-0x0000000002E10000-memory.dmp

Download

memory/732-35-0x0000000007830000-0x000000000784E000-memory.dmp

Download

memory/732-36-0x0000000007850000-0x00000000078F3000-memory.dmp

Download

memory/732-26-0x0000000002E00000-0x0000000002E10000-memory.dmp

Download

memory/732-25-0x0000000002E00000-0x0000000002E10000-memory.dmp

Download

memory/732-24-0x0000000070D40000-0x0000000071094000-memory.dmp

Download

memory/732-37-0x0000000007940000-0x000000000794A000-memory.dmp

Download

memory/732-38-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Download

memory/732-39-0x0000000007950000-0x0000000007961000-memory.dmp

Download

memory/732-41-0x00000000079B0000-0x00000000079C4000-memory.dmp

Download

memory/732-40-0x0000000007990000-0x000000000799E000-memory.dmp

Download

memory/732-21-0x000000007F190000-0x000000007F1A0000-memory.dmp

Download

memory/732-42-0x00000000079F0000-0x0000000007A0A000-memory.dmp

Download

memory/732-1-0x0000000002CB0000-0x0000000002CE6000-memory.dmp

Download

memory/732-2-0x0000000002E00000-0x0000000002E10000-memory.dmp

Download

memory/732-3-0x0000000005460000-0x0000000005A88000-memory.dmp

Download

memory/732-4-0x00000000053B0000-0x00000000053D2000-memory.dmp

Download

memory/732-5-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/732-6-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Download

memory/732-14-0x0000000005C20000-0x0000000005F74000-memory.dmp

Download

memory/732-0-0x0000000002E00000-0x0000000002E10000-memory.dmp

Download

memory/732-19-0x0000000007CD0000-0x000000000834A000-memory.dmp

Download

memory/732-18-0x00000000073A0000-0x0000000007416000-memory.dmp

Download

memory/732-17-0x00000000067D0000-0x0000000006814000-memory.dmp

Download

memory/732-15-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/732-16-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/820-243-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/820-251-0x0000000007020000-0x0000000007031000-memory.dmp

Download

memory/820-252-0x0000000004E40000-0x0000000004E54000-memory.dmp

Download

memory/820-242-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/892-66-0x0000000007B70000-0x0000000007B84000-memory.dmp

Download

memory/892-65-0x0000000007B20000-0x0000000007B31000-memory.dmp

Download

memory/892-64-0x0000000007840000-0x00000000078E3000-memory.dmp

Download

memory/892-56-0x0000000071460000-0x00000000717B4000-memory.dmp

Download

memory/892-55-0x0000000070CC0000-0x0000000070D0C000-memory.dmp

Download

memory/892-54-0x0000000006BE0000-0x0000000006C2C000-memory.dmp

Download

memory/892-51-0x0000000005F60000-0x00000000062B4000-memory.dmp

Download

memory/2228-194-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/2228-193-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/2424-153-0x0000000005F40000-0x0000000005F54000-memory.dmp

Download

memory/2424-143-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/2424-144-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/2772-222-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/2772-239-0x0000000005E70000-0x0000000005E84000-memory.dmp

Download

memory/2772-231-0x0000000005E20000-0x0000000005E31000-memory.dmp

Download

memory/2772-221-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/3052-120-0x0000000006220000-0x000000000626C000-memory.dmp

Download

memory/3052-142-0x0000000005C80000-0x0000000005C94000-memory.dmp

Download

memory/3052-141-0x0000000005C40000-0x0000000005C51000-memory.dmp

Download

memory/3052-140-0x0000000007410000-0x00000000074B3000-memory.dmp

Download

memory/3052-131-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/3052-132-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/3052-118-0x0000000005D40000-0x0000000006094000-memory.dmp

Download

memory/3464-97-0x0000000070CC0000-0x0000000070D0C000-memory.dmp

Download

memory/3464-98-0x0000000071460000-0x00000000717B4000-memory.dmp

Download

memory/4124-174-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Download

memory/4124-166-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/4124-165-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/4124-183-0x0000000006240000-0x0000000006254000-memory.dmp

Download

memory/4124-182-0x0000000007E10000-0x0000000007E21000-memory.dmp

Download

memory/4204-80-0x0000000071290000-0x00000000715E4000-memory.dmp

Download

memory/4204-79-0x0000000070CC0000-0x0000000070D0C000-memory.dmp

Download

memory/4204-77-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Download

memory/4324-211-0x0000000070DA0000-0x00000000710F4000-memory.dmp

Download

memory/4324-210-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download