glupteba | a608a072eb0b271933900bc9c68a099399b7a46e9bb8b69415ec9f394e63351e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp4xihp8oc.exe
Size 9.1MB
Sample260602-ltdmlaat8t
SHA256 a608a072eb0b271933900bc9c68a099399b7a46e9bb8b69415ec9f394e63351e
MD5 552ae135bf740ea0c54b9eec3eafe72b
SHA1 1536eb1603c4c8befa3d761f2d30dd99dbed5faf
SHA512 c2ceb015bf0d0b4919b42beb85c1be18a77b63428eb925145b21739f0357731f753ad456feb1808fa35011e565bbd94c022a1b27a2394960589c5ebe33fcd784
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfQhZytTD5iqu:sxEvYjVzANIhwN
TLSH
T154A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000243ca-106.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2564	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4216	csrss.exe
4688	csrss.exe
1268	csrss.exe
4920	csrss.exe
4692	csrss.exe
2064	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmp4xihp8oc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmp4xihp8oc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmp4xihp8oc.exe
File created	C:\Windows\rss\csrss.exe	tmp4xihp8oc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe
2260	powershell.exe
4588	powershell.exe
2920	powershell.exe
4656	powershell.exe
4244	powershell.exe
2052	powershell.exe
1164	powershell.exe
4848	powershell.exe
748	powershell.exe
3764	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4xihp8oc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4xihp8oc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3376	schtasks.exe
2752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	powershell.exe
3764	powershell.exe
4908	tmp4xihp8oc.exe
4908	tmp4xihp8oc.exe
1164	powershell.exe
1164	powershell.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4644	tmp4xihp8oc.exe
4000	powershell.exe
4000	powershell.exe
2260	powershell.exe
2260	powershell.exe
4848	powershell.exe
4848	powershell.exe
4588	powershell.exe
4588	powershell.exe
4848	powershell.exe
4588	powershell.exe
748	powershell.exe
748	powershell.exe
748	powershell.exe
4688	csrss.exe
4688	csrss.exe
2920	powershell.exe
2920	powershell.exe
2920	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
4244	powershell.exe
4244	powershell.exe
4920	csrss.exe
4920	csrss.exe
4244	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
4216	csrss.exe
4216	csrss.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
2064	injector.exe
4216	csrss.exe
4216	csrss.exe
2064	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	4908	tmp4xihp8oc.exe
Token: SeImpersonatePrivilege	4908	tmp4xihp8oc.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	4688	csrss.exe
Token: SeImpersonatePrivilege	4688	csrss.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4920	csrss.exe
Token: SeImpersonatePrivilege	4920	csrss.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	4216	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3764	4908	tmp4xihp8oc.exe	88
PID 4644 wrote to memory of 1164	4644	tmp4xihp8oc.exe	96
PID 4644 wrote to memory of 3944	4644	tmp4xihp8oc.exe	98
PID 3944 wrote to memory of 2564	3944	cmd.exe	100
PID 4644 wrote to memory of 4000	4644	tmp4xihp8oc.exe	101
PID 4644 wrote to memory of 2260	4644	tmp4xihp8oc.exe	103
PID 4644 wrote to memory of 4216	4644	tmp4xihp8oc.exe	105
PID 4216 wrote to memory of 4848	4216	csrss.exe	108
PID 4688 wrote to memory of 4588	4688	csrss.exe	110
PID 4216 wrote to memory of 748	4216	csrss.exe	116
PID 1268 wrote to memory of 2920	1268	csrss.exe	127
PID 4920 wrote to memory of 4656	4920	csrss.exe	131
PID 4216 wrote to memory of 4244	4216	csrss.exe	133
PID 4692 wrote to memory of 2052	4692	csrss.exe	137
PID 4216 wrote to memory of 2064	4216	csrss.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp4xihp8oc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp4xihp8oc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Users\Admin\AppData\Local\Temp\tmp4xihp8oc.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4xihp8oc.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3376
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1308
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2064
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2752

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 2808ee5224dec15f925f900e885f240483427f9af17dd2bfa8d83e4b832fb937
MD5 a4deff7c3cd5952e13572545c8dcd310
SHA1 c9b26436fb2a52434da01e7540a94dfe80da2132
SHA512 55e87e8817317e7b89e60c15ea39bd0f19298746e5951d156a05f26b83b5507ba925f7e5e7ec1524dd7d44fb6269c427b58b7cfe13965e3fbee87e00be0d4035
SSDEEP 384:dsf+hoS9i+uNhTizjncwhywok+o9o2TpK6seYbneCx/xoTLYbLU0SF5Lt9KqA/9t:CfAmwjncZ0jo2TpN+nl0Y/XYLt96fOKl
TLSH
T1DDA2F85E618F1AC3C4865378D10A040FE8F1DE8D431926D8BB1F8F7B8AAC6BF6178548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 e4e99393ad273725794bca88592fcc6cac74483ce7e0d6597b1e88791035c700
MD5 1241610ffb43d8587f4c811743f35a80
SHA1 9ceb17acddd927334f2b38d7db9cd83576a3641b
SHA512 4ca326038af962a68a5eeefc5e7d30cde12479e9a83e87914f3484120e672f54132257c3ad4528d9a7855249661e4992b39910050d84ff61e422b789efcd3b0c
SSDEEP 384:/sf+hoH91i5nD42awrARNYFFNpfNlx/xUDsXc2oUIKJnhLWKWiTA+n2JBLjhnROg:0fAIie2a8ARN8FNpfFuwWUB/KmCLFD
TLSH
T1C8A2295A621F3A97E0A92378D42607DBE1F0EDCEC30017CD674A59371ACEA75A0F85D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vkdovki1.ord.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkdovki1.ord.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 23114c65aa2c99490486e52cceec1bfa95b9f4b1c35f7c0c4af0e27a66e81b6d
MD5 d8d78f07f1b8ac0fb0577b82c4999d72
SHA1 1b7ad23942fcff87b07f8c21be8cfc5bc2e8ff95
SHA512 fb3a69395caf975b47f19231932c70e519ed1aebbd2c7006bfe2a2a4eb07127323d2594bcdd5394e1fe292ea05ce0ab3a0f55df845a6c2f159d6b2954d1e3059
SSDEEP 384:18sf+Bh9RBY3AKh7jmQ1RDokAlNYPjffemRc7/ZocmPMtJMR1E4+nFbOuj3luJ0y:15fUYTV15okAlNijffs7BUcmR1q4ublQ
TLSH
T1C8923A9D221F2A97C0A513F4D42743DFE8B09DCF834407DE67492E3B06DA77958A82E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 809241bfc1e4b7897b3c2d410a6fcafa3b64bca629d846685b8252781398c473
MD5 21a90711ddb7f5b11ab643c2702b2594
SHA1 b011ee2f5157acfd3cec8b19459c6d929a795f0a
SHA512 3e502fb5f4248885248ad415de5f437f570038e16a8dbf3f56cc0deac2a913889ae308d72be1ba778ea045d44466f4723d836a0411e434bdc3388929b01276b5
SSDEEP 384:M6+BHRBasMsNnXi0Xkyto9orjT3KYYPNpfem1w7/IORwXlxz1fGR+nFbOuj3lu3c:tEaOy00jorjT3NiNpf87kZ1f54ublT
TLSH
T19492495D621F2AC7D0A613F4C02647DBD9B09CCFC3440BDE57865A3B06DAB7984A91F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 32d598cab0ab6161a809737169b0d5c311ed997575ae1098547384db00498769
MD5 4752fd14b14d65f19eeabb26ea5a1f9f
SHA1 478a27453e9eceebedcb67f7235dbd0b3159770c
SHA512 7407e469dd29a80e844d0c5046b7e99a6819bc960bb71dc437895a18aa48aaf6b94976c3e5a716d79e3287d8645f35821b6f2f53eb127217fbd2bf94e307c341
SSDEEP 384:msf+B19RBOwWIK425qiJkyto93BRNYFFjffem1c7/IOKPMldy1Prws+nFbOuj3lj:jfgOW2mj3BRN8FjffY7SUI1a4ublj
TLSH
T1CA924A5E621F2696E02613F0D42B47DBE9F0ADCFC38406DE57855E3B06CABB584D80E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 f2ef567cc1ab6ead24b6990340d6ed4edcb6f1bfe39b145a5b3198967dd7ffd6
MD5 b0ac649b560d0d5eeebd36a43c9ac14a
SHA1 5ec7421069e92a448612cb90d06b512de8c107f7
SHA512 5a1850e9e1c0e68ce6c261b6ca0070cceef7f6f8edc9a6c75413b3dcccde6008f3b30c0b0f07a53c5b1bc9570d6559220a6341cc25a900111d1d6c73ff21c5dd
SSDEEP 384:8sf+BHRBo7zBBizJ0eMto9onARNYFFNpfem1w7/ZKPMldd1PrwM+nFbOuj3l/UOg:5fEoxoVBonARN8FNpf87SUj1a4ubls
TLSH
T11292185D620F3ADBD4A613B4C42B47EFE9B08DCFC30007DE2789692B16CA67544994ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2e2d2b692ceac1f00a276c8b22caa68f6e1953dbe91ba3374f5f1b645772d991
MD5 6ef2d41e2620e1181510efe9c73168d2
SHA1 eb4a4ced4769ade772303d0286728774d84e1e6b
SHA512 708c3e6e14286418b6604249e364e3b0587ba1f90aa3fc29128e511afce0843e3d2cbbb63336629926543900f0fcfdfb095c43108a82f780a044f3d7a08a9934
SSDEEP 384:hsf+B99m+eViDm2CDzWJCro9o2T9K6seYbne28v/ZJwMHhOqEIjaLFqZbObTUSG2:GfBV/2Uq4co2T9N+ncvhOqEII4qMB2
TLSH
T18A92E65E201F16C3C48513B8E11B054FE8F2DE8D530A17D8BB1E9F3B8AAC69E913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2bc8c1d9a2bce115d77bde457308bd355fe18fa210583b79f700530091568033
MD5 f43acce000f1670ae8ae71de60763110
SHA1 b82441b0cb4749f0b5ad4788c5a956629f1eb7c5
SHA512 2d7a0b77e889ce300b081edf0e29aca8849239438a521b14aab1a56958a9357db7fd9eab474345e95fe6977cdb418cebe6cf86139c662e0a1a721290a896f74b
SSDEEP 384:ssf+Bm9RBfJgcwG/x0JkiAo9oSwNYFFNpfemFw7/IOGtqVJ+1EM+nFbOuj3iusOg:JfJfecwGJ1iVofN8FNpfM7gGI1u4ubij
TLSH
T11992295D221F2A97D09613F4D42B43EFE8B09DCF830407DD67896E3B06CA7B584A95E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 a608a072eb0b271933900bc9c68a099399b7a46e9bb8b69415ec9f394e63351e
MD5 552ae135bf740ea0c54b9eec3eafe72b
SHA1 1536eb1603c4c8befa3d761f2d30dd99dbed5faf
SHA512 c2ceb015bf0d0b4919b42beb85c1be18a77b63428eb925145b21739f0357731f753ad456feb1808fa35011e565bbd94c022a1b27a2394960589c5ebe33fcd784
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfQhZytTD5iqu:sxEvYjVzANIhwN
TLSH
T154A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-187-0x0000000005C70000-0x0000000005C84000-memory.dmp

Download

memory/748-162-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/748-179-0x00000000073C0000-0x00000000073D1000-memory.dmp

Download

memory/748-171-0x0000000007090000-0x0000000007133000-memory.dmp

Download

memory/748-163-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/1164-63-0x0000000007590000-0x00000000075A1000-memory.dmp

Download

memory/1164-50-0x0000000005A30000-0x0000000005D84000-memory.dmp

Download

memory/1164-53-0x0000000070380000-0x00000000703CC000-memory.dmp

Download

memory/1164-54-0x0000000070B10000-0x0000000070E64000-memory.dmp

Download

memory/1164-62-0x00000000072A0000-0x0000000007343000-memory.dmp

Download

memory/1164-52-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/1164-64-0x00000000075E0000-0x00000000075F4000-memory.dmp

Download

memory/2052-240-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/2052-249-0x00000000079E0000-0x00000000079F1000-memory.dmp

Download

memory/2052-248-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/2052-250-0x00000000062D0000-0x00000000062E4000-memory.dmp

Download

memory/2052-239-0x0000000070210000-0x000000007025C000-memory.dmp

Download

memory/2260-94-0x0000000070380000-0x00000000703CC000-memory.dmp

Download

memory/2260-95-0x0000000070B10000-0x0000000070E64000-memory.dmp

Download

memory/2920-190-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/2920-189-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/3764-5-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/3764-17-0x0000000006DF0000-0x0000000006E34000-memory.dmp

Download

memory/3764-36-0x0000000008030000-0x00000000080C6000-memory.dmp

Download

memory/3764-35-0x0000000007F70000-0x0000000007F7A000-memory.dmp

Download

memory/3764-15-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/3764-41-0x0000000008010000-0x0000000008018000-memory.dmp

Download

memory/3764-34-0x0000000007E80000-0x0000000007F23000-memory.dmp

Download

memory/3764-0-0x00000000032B0000-0x00000000032C0000-memory.dmp

Download

memory/3764-38-0x0000000007FD0000-0x0000000007FDE000-memory.dmp

Download

memory/3764-32-0x00000000032B0000-0x00000000032C0000-memory.dmp

Download

memory/3764-33-0x0000000007E60000-0x0000000007E7E000-memory.dmp

Download

memory/3764-1-0x00000000032C0000-0x00000000032F6000-memory.dmp

Download

memory/3764-24-0x0000000070850000-0x0000000070BA4000-memory.dmp

Download

memory/3764-2-0x00000000032B0000-0x00000000032C0000-memory.dmp

Download

memory/3764-23-0x0000000070280000-0x00000000702CC000-memory.dmp

Download

memory/3764-3-0x0000000005BD0000-0x00000000061F8000-memory.dmp

Download

memory/3764-4-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/3764-40-0x00000000080D0000-0x00000000080EA000-memory.dmp

Download

memory/3764-37-0x0000000007F90000-0x0000000007FA1000-memory.dmp

Download

memory/3764-39-0x0000000007FE0000-0x0000000007FF4000-memory.dmp

Download

memory/3764-16-0x00000000068D0000-0x000000000691C000-memory.dmp

Download

memory/3764-14-0x0000000006300000-0x0000000006654000-memory.dmp

Download

memory/3764-6-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/3764-22-0x0000000007E20000-0x0000000007E52000-memory.dmp

Download

memory/3764-21-0x000000007EF60000-0x000000007EF70000-memory.dmp

Download

memory/3764-20-0x0000000007C60000-0x0000000007C7A000-memory.dmp

Download

memory/3764-19-0x00000000082C0000-0x000000000893A000-memory.dmp

Download

memory/3764-18-0x0000000007BC0000-0x0000000007C36000-memory.dmp

Download

memory/4000-77-0x0000000070B10000-0x0000000070E64000-memory.dmp

Download

memory/4000-76-0x0000000070380000-0x00000000703CC000-memory.dmp

Download

memory/4244-221-0x0000000070210000-0x000000007025C000-memory.dmp

Download

memory/4244-237-0x00000000065F0000-0x0000000006604000-memory.dmp

Download

memory/4244-220-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/4244-222-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/4588-150-0x0000000005EE0000-0x0000000005EF4000-memory.dmp

Download

memory/4588-139-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/4588-140-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/4656-199-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/4656-198-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/4848-148-0x0000000005DC0000-0x0000000005DD4000-memory.dmp

Download

memory/4848-138-0x00000000075B0000-0x00000000075C1000-memory.dmp

Download

memory/4848-137-0x0000000007220000-0x00000000072C3000-memory.dmp

Download

memory/4848-128-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/4848-129-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

Download

memory/4848-126-0x0000000006060000-0x00000000060AC000-memory.dmp

Download

memory/4848-116-0x00000000058E0000-0x0000000005C34000-memory.dmp

Download