glupteba | 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpgc5pndng.exe
Size 9.1MB
Sample260602-lsla2sat6v
SHA256 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89
MD5 d45b8f133e6629d1cfb5471810138e47
SHA1 ae3b70e7b61d0506a6fc94a9e2767faa41e37e8a
SHA512 d38af500cc9402b06571bbde0dd8a8bec0c17787c875ccfd5b34c2909425ce270a5dcc017e4ef728578a4979bf3601e502d271522ee7cee278dd13b93875a1b0
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfShZytTD5iqr:sxEvYjVzANqhwN
TLSH
T191A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001500000002b041-98.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4728	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3832	csrss.exe
4476	csrss.exe
1664	csrss.exe
2880	csrss.exe
4168	csrss.exe
4008	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpgc5pndng.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpgc5pndng.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpgc5pndng.exe
File created	C:\Windows\rss\csrss.exe	tmpgc5pndng.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
228	powershell.exe
2316	powershell.exe
4752	powershell.exe
4500	powershell.exe
2212	powershell.exe
1428	powershell.exe
4064	powershell.exe
764	powershell.exe
392	powershell.exe
1232	powershell.exe
3332	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgc5pndng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgc5pndng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2420	schtasks.exe
4640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4064	powershell.exe
4064	powershell.exe
3984	tmpgc5pndng.exe
3984	tmpgc5pndng.exe
764	powershell.exe
764	powershell.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
4048	tmpgc5pndng.exe
228	powershell.exe
228	powershell.exe
2316	powershell.exe
2316	powershell.exe
4752	powershell.exe
4500	powershell.exe
4752	powershell.exe
4500	powershell.exe
392	powershell.exe
392	powershell.exe
4476	csrss.exe
4476	csrss.exe
2212	powershell.exe
2212	powershell.exe
1232	powershell.exe
1232	powershell.exe
1428	powershell.exe
1428	powershell.exe
2880	csrss.exe
2880	csrss.exe
3332	powershell.exe
3332	powershell.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
3832	csrss.exe
3832	csrss.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
3832	csrss.exe
3832	csrss.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe
4008	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3984	tmpgc5pndng.exe
Token: SeImpersonatePrivilege	3984	tmpgc5pndng.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	4476	csrss.exe
Token: SeImpersonatePrivilege	4476	csrss.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	2880	csrss.exe
Token: SeImpersonatePrivilege	2880	csrss.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeSystemEnvironmentPrivilege	3832	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4064	3984	tmpgc5pndng.exe	82
PID 4048 wrote to memory of 764	4048	tmpgc5pndng.exe	87
PID 4048 wrote to memory of 2988	4048	tmpgc5pndng.exe	89
PID 2988 wrote to memory of 4728	2988	cmd.exe	91
PID 4048 wrote to memory of 228	4048	tmpgc5pndng.exe	92
PID 4048 wrote to memory of 2316	4048	tmpgc5pndng.exe	94
PID 4048 wrote to memory of 3832	4048	tmpgc5pndng.exe	96
PID 3832 wrote to memory of 4752	3832	csrss.exe	97
PID 4476 wrote to memory of 4500	4476	csrss.exe	101
PID 3832 wrote to memory of 392	3832	csrss.exe	107
PID 1664 wrote to memory of 2212	1664	csrss.exe	118
PID 2880 wrote to memory of 1232	2880	csrss.exe	120
PID 3832 wrote to memory of 1428	3832	csrss.exe	122
PID 4168 wrote to memory of 3332	4168	csrss.exe	125
PID 3832 wrote to memory of 4008	3832	csrss.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe
"C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpgc5pndng.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4728
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4752
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4640
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4008
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2420

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2212

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 be79edf11d8792aee34ed8f9255be76c0080cd53af2e7fcd2600d1be415ba944
MD5 a5b83e95f3c33b81a98af1c8eac8ec20
SHA1 4103177c30fa4b14ffabc82c8c1ab6c232021b9a
SHA512 b4ebec28f7bab7452f2b638d01482065e148210ca9de395c4fea89748fae6d723bf8e28cf72c143434a8994477762d4e9a30389d0c708446b8d1e1611ca632db
SSDEEP 384:5L3HhwySS1a3kKufYo6FRH7jAHnnN/jQGIC1Lj5vsUjjqOyEIDXiJwLOj9hFy:BxXSS8UBfKRbQN/jfIC1L9vxjqd9DXiw
TLSH
T1DE92D6AE711F16C3C89563B8D106040FE8F2DE8D031956DCBB2E8E7B89AC95F517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 9d028c6cb29599f7ec06abb05888d8f2fa692f6cb25823fda6551d92659e334c
MD5 908efdbc6b1814c5c2366ebfb91e8467
SHA1 8babd62afe92ebd81dd09f265564e7b5095a1693
SHA512 6adfa08e87fb16ce9b057218824e265a923b7ce09b2b3bc8ccdbac2727cc2e98b0c743196d53320ec0398cb0ca8c97c0eb6e814753f61dea5194936d509c9c4c
SSDEEP 384:FAL3Hhwz1SGAjzLW6FRHEMEcHeH9tjWaK2EK2GmeVdq4Gexyb0WxLSnY9phUUd9H:IxISja6RPEtPjWaBEKZ5Vw8hWl99pyUr
TLSH
T144921959221F2ADBE86623F8C42207CFF6F189DEC38096CE6359583B05CA66454FD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nunwzh1h.ttq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nunwzh1h.ttq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2a57d04eac297ff0179223ccbab47aacf495b0f92a626d1af7f265a9be30e998
MD5 686d576110f9a89fee3e2db187e2005c
SHA1 dcf7de127bdd80c431debb62f2ef309c00ac8f37
SHA512 cb1b39cfd61400703a133659cb08b5fac94e5b777b95b2bf54efbd08a3037d2bdd94b8bf1743c99eafef0dd7d1805236f169aaa58a0c6bfaf3eb0b76695401fb
SSDEEP 384:0THhv1S25iaLSWAME0QZczRjWaK2KLNXjIHbffmz/nY9jhUdgH:SSONXE0NjWaBKLNzIb2zA9lUE
TLSH
T11A92395D226F269BF56613F8C0260B8BF9F09ACEC34056CE93165C3A05CA66184E95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1cf74d6884a82df54302d30714bb6d974e50a3e9bbdf4c7b2476f22d80005a8f
MD5 cfef7de9f2bbff4052715de9d819e6d7
SHA1 e84720c64aa4a181faf0fd5de6bedd7d0c1905e3
SHA512 8a72b09d56b2412f229237776407d46ae83a106de52abef41c89bb86433285a4576be12c267fc962b9d5437b2dbc938dc370acf59324243805a5dec7fd62b032
SSDEEP 384:TL3HhpSStc7jA86FRHEMEYHWQhHdjc2jiLNX2MHm4b700zenY9jhUd9H:HfSSyvA86RPEkWCjvOLNDbHzB9lUr
TLSH
T13F92386D322F369BC4A513F8C422179BEDA09EDF430497DE670A5D3B05CB63084A85EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ef12a55768214400a7824542248b72e2d7c523ee218328c6b8619e64c05b7136
MD5 0e78205091ac126fdb8ca1088c3c1504
SHA1 293b5e16f7a8a0896d30ee6926e626449dccfed3
SHA512 e99b27b0e4bd9fc14232368bb5da53857cc8e80fc085e27dea2ea55108246ee692e52b7ef656ce505c5fb52744ac10178606d4609d32de705eae553d6b1bd059
SSDEEP 384:xTHhwS2IqSTFRHEME+OHHNzjQr24NHhHmHbXfK6iI2nY9jhUdBH:sSDqShRPE+ONzjv4N0bS6iA9lUT
TLSH
T1E2923969322F2687C4A823F5902607DBEEB09ECF438457DE935A9C3F04CB67184995E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ba1756ff6e0128f58d149ca3ce4e0db21dd06a979e88ab6b13fdcaa666d9aa88
MD5 ef22f75532eb14bdaa56f06340bcffaf
SHA1 05d05c26a102f9c451bd83e762adb69c59131acd
SHA512 da5c3441ae971dd8cd9a0f44c2fd2fc15d96ad4ade920c033c1a10a8b13005ca444ce15315df2a57a855873df1ec9ac9d2420025db8f35f7f105267df7a4f196
SSDEEP 384:4THhz1S2kAJf3lXLFRHEMEyHHHhjc2eLNbRHmHbr0U6ibnY9jhUdkH:iS36/RpRPEyhjveLNAb/6iE9lU0
TLSH
T10C92395D226F36DBC4A613F4C0231BDBEEB09ECE834496DDA359983B04CF67184995E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 df123a54b4a7612b602a956b58d2771e6f8d86e234d546e93d2c17afae368de6
MD5 8de3c9c13f227c5f38138919ec1bf48d
SHA1 6927232d9ed1056963285612712d8f0115fcae6c
SHA512 b97f1894e1702053f9faf2cfdc6333ff9198d2e8fc9fccd2ba5dc468f3fcd76eb61b13d0164afbdae5dd3fe10d092074c8321d218239e2b9e312cbccde9103b8
SSDEEP 384:6THhz1S2kj7CitLV0CWUTcznNjWaK2OLNXEHbI0z/nY9jhUd9H:8S3/CitnWUopjWaBOLNUbHzA9lUr
TLSH
T167923869326F26DBD0A523B8C02607DBFDF08ECEC30457DE5259593B05CF67284A96E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 914a3ef2b76af94069ec293c84d6fb03ad76c485d4486a42079a898b4212733a
MD5 1520f602c38e9d4437a832c4018cfa3a
SHA1 8fc12c3c6aa0c4c1c454986f2c24647c27e3eed3
SHA512 9d8c37279481093eba99d7709ca8b65274d4ca1e237f91383930b977279753e1e9adabe82be76a25edfbde3a79c6be91110ad55fe97c14b2ceb6d009d7dac163
SSDEEP 384:GTHhwSSJ5Tz4PKwRHEME7HnnNzjQGII+NXjg2x+bX/Hz5RjNadF+:pSSX4PtRPEbNzjfII+NzgC+bXPz5Kdk
TLSH
T1ED92D5AE711F22C3C89553B8D10A050FE8F2DE8D431A12D9BB2E9F7B89AC55E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2ad7b7df7d74565b13e739a1d50608d7694de40ff018146fc61df894e6777f20
MD5 ed7c273c3adbf052d5750a3a2b8f60ea
SHA1 659eb2252c5cc11dcf02b44bd927eeedaa38cd61
SHA512 3ab26735fef9e9dacf81d5cc3453455f572dcc4a33062f405d0e3ae2c3e28a82964bbe2797a4997c5f886046b4f267c55c481b9e52b8ca2ef273ab6a018f2e32
SSDEEP 384:PTHhtZAStFw2nPFRs5MEoLdieHnNjF1ICeLNXjS/HbrqzvnY9jhUdwH:fZAS029R1EoLzNjF1ICeLNzwb+zw9lUk
TLSH
T10992296D226F269BE4A513F8C026079BFDF09ECFC34453DE674A683B05CB27140A95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 7f25ddaf44eb5915cb65abcbe93ed728a4d49cc824af5340afea57b3c0302e89
MD5 d45b8f133e6629d1cfb5471810138e47
SHA1 ae3b70e7b61d0506a6fc94a9e2767faa41e37e8a
SHA512 d38af500cc9402b06571bbde0dd8a8bec0c17787c875ccfd5b34c2909425ce270a5dcc017e4ef728578a4979bf3601e502d271522ee7cee278dd13b93875a1b0
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfShZytTD5iqr:sxEvYjVzANqhwN
TLSH
T191A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-71-0x00000000706F0000-0x0000000070A47000-memory.dmp

Download

memory/228-70-0x00000000704B0000-0x00000000704FC000-memory.dmp

Download

memory/392-149-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/392-150-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/392-171-0x0000000005790000-0x00000000057A5000-memory.dmp

Download

memory/392-164-0x0000000007370000-0x0000000007381000-memory.dmp

Download

memory/392-157-0x0000000007030000-0x00000000070D4000-memory.dmp

Download

memory/764-57-0x0000000006E80000-0x0000000006F24000-memory.dmp

Download

memory/764-49-0x00000000704B0000-0x00000000704FC000-memory.dmp

Download

memory/764-59-0x0000000007220000-0x0000000007235000-memory.dmp

Download

memory/764-58-0x00000000071D0000-0x00000000071E1000-memory.dmp

Download

memory/764-50-0x00000000706F0000-0x0000000070A47000-memory.dmp

Download

memory/764-41-0x0000000005720000-0x0000000005A77000-memory.dmp

Download

memory/764-48-0x0000000006160000-0x00000000061AC000-memory.dmp

Download

memory/1232-188-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/1232-189-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/1428-215-0x0000000005C00000-0x0000000005C15000-memory.dmp

Download

memory/1428-199-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/1428-198-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/2212-175-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/2212-174-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/2316-87-0x00000000704B0000-0x00000000704FC000-memory.dmp

Download

memory/2316-85-0x0000000005F60000-0x00000000062B7000-memory.dmp

Download

memory/2316-88-0x0000000070630000-0x0000000070987000-memory.dmp

Download

memory/3332-217-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/3332-218-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/3332-225-0x0000000007C90000-0x0000000007CA1000-memory.dmp

Download

memory/3332-230-0x0000000006430000-0x0000000006445000-memory.dmp

Download

memory/4064-20-0x00000000705B0000-0x0000000070907000-memory.dmp

Download

memory/4064-28-0x00000000073F0000-0x000000000740E000-memory.dmp

Download

memory/4064-1-0x0000000002AF0000-0x0000000002B26000-memory.dmp

Download

memory/4064-15-0x0000000006020000-0x000000000606C000-memory.dmp

Download

memory/4064-14-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Download

memory/4064-12-0x0000000005AE0000-0x0000000005E37000-memory.dmp

Download

memory/4064-34-0x00000000075A0000-0x00000000075B1000-memory.dmp

Download

memory/4064-33-0x0000000007690000-0x0000000007726000-memory.dmp

Download

memory/4064-32-0x0000000007580000-0x000000000758A000-memory.dmp

Download

memory/4064-17-0x000000007F6A0000-0x000000007F6B0000-memory.dmp

Download

memory/4064-2-0x0000000002C70000-0x0000000002C80000-memory.dmp

Download

memory/4064-35-0x00000000075F0000-0x00000000075FE000-memory.dmp

Download

memory/4064-36-0x0000000007600000-0x0000000007615000-memory.dmp

Download

memory/4064-37-0x0000000007650000-0x000000000766A000-memory.dmp

Download

memory/4064-38-0x0000000007670000-0x0000000007678000-memory.dmp

Download

memory/4064-6-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/4064-0-0x0000000002C70000-0x0000000002C80000-memory.dmp

Download

memory/4064-3-0x00000000052D0000-0x00000000058FA000-memory.dmp

Download

memory/4064-30-0x0000000007B80000-0x00000000081FA000-memory.dmp

Download

memory/4064-31-0x0000000007540000-0x000000000755A000-memory.dmp

Download

memory/4064-29-0x0000000007410000-0x00000000074B4000-memory.dmp

Download

memory/4064-5-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/4064-16-0x00000000064F0000-0x0000000006536000-memory.dmp

Download

memory/4064-18-0x0000000007390000-0x00000000073C4000-memory.dmp

Download

memory/4064-19-0x00000000703A0000-0x00000000703EC000-memory.dmp

Download

memory/4064-4-0x00000000050D0000-0x00000000050F2000-memory.dmp

Download

memory/4064-27-0x0000000002C70000-0x0000000002C80000-memory.dmp

Download

memory/4500-138-0x0000000005E80000-0x0000000005E95000-memory.dmp

Download

memory/4500-128-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/4500-129-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/4752-119-0x0000000070650000-0x00000000709A7000-memory.dmp

Download

memory/4752-126-0x00000000075A0000-0x0000000007644000-memory.dmp

Download

memory/4752-118-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/4752-136-0x0000000006130000-0x0000000006145000-memory.dmp

Download

memory/4752-127-0x00000000078F0000-0x0000000007901000-memory.dmp

Download

memory/4752-117-0x00000000067F0000-0x000000000683C000-memory.dmp

Download

memory/4752-101-0x0000000005DB0000-0x0000000006107000-memory.dmp

Download