glupteba | 803f3f2bd778da1644ef1a86c688fe3e051e62cc687622aaf22eea4fa87870de

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpcpclupsa.exe
Size 9.1MB
Sample260602-lv7basav5s
SHA256 803f3f2bd778da1644ef1a86c688fe3e051e62cc687622aaf22eea4fa87870de
MD5 c818a501deaea0c382dd89981fc7bb1e
SHA1 db01645b520e69442ffc471eab5f9a5b643654a1
SHA512 2b475a6b02356393175a90193d8cc4b5d49843d1c6314adb794e0a167c1797c73622472e02f1f0087bbb0b137077e55d52a48deed074c89cc4790906b5b6be10
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfRhZytTD5iqy:sxEvYjVzAN5hwN
TLSH
T1D9A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002445d-108.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4696	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3928	csrss.exe
2036	csrss.exe
2844	csrss.exe
3204	csrss.exe
2004	csrss.exe
648	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpcpclupsa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpcpclupsa.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpcpclupsa.exe
File created	C:\Windows\rss\csrss.exe	tmpcpclupsa.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3156	powershell.exe
1060	powershell.exe
4316	powershell.exe
1248	powershell.exe
1544	powershell.exe
1844	powershell.exe
5064	powershell.exe
4368	powershell.exe
784	powershell.exe
4352	powershell.exe
648	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpcpclupsa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpcpclupsa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3260	schtasks.exe
4364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
4800	tmpcpclupsa.exe
4800	tmpcpclupsa.exe
1060	powershell.exe
1060	powershell.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
748	tmpcpclupsa.exe
5064	powershell.exe
5064	powershell.exe
4316	powershell.exe
4316	powershell.exe
4368	powershell.exe
4368	powershell.exe
784	powershell.exe
784	powershell.exe
4368	powershell.exe
784	powershell.exe
2036	csrss.exe
2036	csrss.exe
4352	powershell.exe
4352	powershell.exe
648	powershell.exe
648	powershell.exe
4352	powershell.exe
4352	powershell.exe
648	powershell.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe
3156	powershell.exe
3156	powershell.exe
3156	powershell.exe
3204	csrss.exe
3204	csrss.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
3928	csrss.exe
3928	csrss.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
648	injector.exe
3928	csrss.exe
3928	csrss.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	4800	tmpcpclupsa.exe
Token: SeImpersonatePrivilege	4800	tmpcpclupsa.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	2036	csrss.exe
Token: SeImpersonatePrivilege	2036	csrss.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	3204	csrss.exe
Token: SeImpersonatePrivilege	3204	csrss.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeSystemEnvironmentPrivilege	3928	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1844	4800	tmpcpclupsa.exe	88
PID 748 wrote to memory of 1060	748	tmpcpclupsa.exe	97
PID 748 wrote to memory of 512	748	tmpcpclupsa.exe	99
PID 512 wrote to memory of 4696	512	cmd.exe	101
PID 748 wrote to memory of 5064	748	tmpcpclupsa.exe	102
PID 748 wrote to memory of 4316	748	tmpcpclupsa.exe	104
PID 748 wrote to memory of 3928	748	tmpcpclupsa.exe	106
PID 3928 wrote to memory of 4368	3928	csrss.exe	136
PID 2036 wrote to memory of 784	2036	csrss.exe	111
PID 3928 wrote to memory of 4352	3928	csrss.exe	118
PID 2844 wrote to memory of 648	2844	csrss.exe	137
PID 3204 wrote to memory of 1248	3204	csrss.exe	130
PID 3928 wrote to memory of 3156	3928	csrss.exe	132
PID 2004 wrote to memory of 1544	2004	csrss.exe	135
PID 3928 wrote to memory of 648	3928	csrss.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpcpclupsa.exe
"C:\Users\Admin\AppData\Local\Temp\tmpcpclupsa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\tmpcpclupsa.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpcpclupsa.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4368
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3260
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4352
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:648
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4364

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:784
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:648

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 4a9d845523f8ded9487e3b994675e909dc5034edf32ab28c2d6d98e1b929b015
MD5 b7857e9c2dcaf7d51737275325d7fb0b
SHA1 641deb9407705047c21b34ef7ba88c26c477862f
SHA512 bcfc4e092171954761c862f3d4a058afd73dda397b42e166a6fb422166b66de2d1b82fbeb78cce830c726b265224093f3df33a48520279da6ad3d6e6e82ccd7e
SSDEEP 384:esf+hoW9i+JfDvActufU5n+dVo7ThK6seYbneyx/xozLYbLU0KF5/t9K2A/9JnA+:LfA1frBmuEVo7ThN+nlUY/XQ/t9u/OKd
TLSH
T166A2E85E618F1AC3C4866378D10B041FE8F2DD8D431926D8BB1F8F778AAD6BE6078548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 3944fbfcf66be0783ad2670694c51f9154d683b18073db3ec60650132237dbbc
MD5 a1b5dad60039e07fc147c16504a2ec2a
SHA1 71be28cb7bb165bf52dfc1f4ef2ae39dabc2b8a7
SHA512 29b7d32d1f36c8391d9ee4f4a1bf7d3d52ad5917af2fdfa2bf7febf9d15a7a7a56758620241edb109e2242742d099a4eac1423356630242708b7ca4dd4a93855
SSDEEP 384:Xsf+hoH91B24sVwQP/YizJk+o9o5ATVNYFFNpfemlx/x9cFDsXc2oUIKg5/bJv63:8fAIBiZ/nejo5ATVN8FNpfFUFwWUBE/e
TLSH
T19AA22A5EA21F3A97C49A13B9C43607DBD4B09DCF83001BCC774B59375689A7960F42E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5fmffl13.ivo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fmffl13.ivo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 332d6b6a72b918627df8866754d1d24cc6af05e6caa382712c5be6fd3d0c4a39
MD5 6579d7c7b1a51ef5c5e5ebf7e8223a4b
SHA1 c90fcf5c662fc66a1c97ae7c7fe0e53628d2f8d4
SHA512 db9c53c91c8a541ad6bfbf405d0e3e2190177c98eaa728c9f770dc6f7f6e3fcd8a764c208966ad69e1cb1d8e49e9b8f6fe27001253cf90de9405679071311c44
SSDEEP 384:q6+BHRBVDlx59riyBktIo981TVNYFFjffemW7/ZKaMlJy1Rjais+nFbOuj3lusOg:3EV99mTt981TVN8Fjff873Uk1RZ4ublj
TLSH
T1B992285D620F2AD7C0A513F8D42A47DBD4B09E8F834017DD678A2E3B56CE36594BC2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2b40ba46808ea90c12c6fd73d7c123267b9ac1239c7212e440da280bab4e368d
MD5 84e046b397df842fdbccade2b4e0dc7f
SHA1 f883577eca39608db5189a4c0a1533b61ccf7943
SHA512 815c0460c8f439fe230929c7890779ca042119790531767c2abe6a3e1ad1e952a9281c92f0d015590d47a0ff1a4a869f731deb83992e59612163feb392fede74
SSDEEP 384:ysf+BHRB+Is+XrY7LvrYizJkyto9o5ADYPNpfNWUOMcmPMloEd1RjxwM+nFbOuj5:vfEO+bY7Drnejo5ADiNpf8xUUj1Rs4uV
TLSH
T1F092275D221F269BD06923F8C83647DBD9709DCFC3440BDDA788A93B06CA26584ED1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e84dcbc2d61d730d6d5f7e292e322421b4523d338474eb1b535e9a914017efc5
MD5 25040dcd0602f3359365904158c9511d
SHA1 47e596d041e77effa2f468cd2e4f7b803a355bc9
SHA512 ee3b7bce12682d4b7b4226d928781a461a96333ab5c67c7f3f50625058612ef84116ac62e930c7e3ff7f5539a8df2f8bfb2b4edebc5c11d2ed4e31ddc19cc0b4
SSDEEP 384:j8sf+BHRBCZKUnorOBFgwho9o2TVNYFpfema7/IOMcmP1YtdQ1/1/+nFbOuj3lsV:j5fECZUO3gwSo2TVNKpfY7FUUa1/84uu
TLSH
T12792299D221F3697E0A613B4C43643E7F9709DDFC38407DE2B4A592B06CA77598A41F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 54c511fdfccd5e825d83586cb851e5ebb3f251f460d1dbd90584dc8f858999ee
MD5 e4abc5f564ae9fcb6a17e6dc6883aa3a
SHA1 19bf59625d15dad2d9fb1d4a2862f45c0acc14c7
SHA512 8ffaaf648b0ac607b1678045dedfccce030c0064f46e22c8bef75908915a4069519f54c32eaf7433b86941679cef537eb3a2a5bdcf40c7aa92cda37bf4a83130
SSDEEP 384:66+BHRBCqw1agLeBihJHHno9oENYPNpfem1c7/ZKaMlxd12+nFbOuj3lu3cOg:n0CqwVKo74oENiNpfY73UP1D4ublT
TLSH
T19992295D221F2A97C0A513B4D42643DFE9B0ADCF83040BDE67895E3B06CE77584A91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 072d3ed9b225bc6284a4e9e66d9cf4ba65e06743da7aafaf54ebb6a2a5116132
MD5 88242dfe4bf290b7ca6d0d043dd694af
SHA1 5407302b1105cf47ead482660a8ea22fba5aa789
SHA512 686c6eafb11a42cda5dd60642129423006ec6aba1c9ab7708f6075d9c800cc1d2842be7ccf00e40e1c8974c072ecf364356782c0899082d8e39713753c336549
SSDEEP 384:Isf+BJ9m+cqj56JBi+Jkko9o2TVK6seYbnem8v/ZhwMH5OGEIjaL+IqZbObTUSj2:FfYjYoDJo2TVN+nsvxOGEIs4qM42
TLSH
T1AC92E75E601F16C3C48513B8E11B055FE8F2DE8D531A17D8BB1E9F3B8AACA9E913C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 a33c1f4e5a665f95125a53257cedad464ea022ab2b7e1c0e7ab503d6d4741f90
MD5 a1807ff933dee4ccf3763cf228791fb8
SHA1 6d02ad35461842546c77f380b8148cbc3b943889
SHA512 87a93c91413969f9500e0bbd273af24e790120f41ba3720ca64ae85f801910f688f2460ad00574c9b12b016bba927e99fb561d1618d49965baa8ad30ae71f05b
SSDEEP 384:K8sf+BnRBaTKNZjmjFBnzbcNYFFjffemW/IOK0oIoac1RGY+nFbOuj3lf0Og:K5fU0KfCLkN8FjffctQ1R84ubls
TLSH
T1D592275D621F2AD2E16613F8C4260BDBF8F09DCFC30006DE5A852E3B06DA77594A91F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 803f3f2bd778da1644ef1a86c688fe3e051e62cc687622aaf22eea4fa87870de
MD5 c818a501deaea0c382dd89981fc7bb1e
SHA1 db01645b520e69442ffc471eab5f9a5b643654a1
SHA512 2b475a6b02356393175a90193d8cc4b5d49843d1c6314adb794e0a167c1797c73622472e02f1f0087bbb0b137077e55d52a48deed074c89cc4790906b5b6be10
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfRhZytTD5iqy:sxEvYjVzAN5hwN
TLSH
T1D9A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-182-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/648-173-0x00000000704E0000-0x000000007052C000-memory.dmp

Download

memory/648-190-0x00000000071D0000-0x00000000071E1000-memory.dmp

Download

memory/648-198-0x0000000005A30000-0x0000000005A44000-memory.dmp

Download

memory/784-150-0x0000000005B40000-0x0000000005B54000-memory.dmp

Download

memory/784-140-0x00000000705C0000-0x000000007060C000-memory.dmp

Download

memory/784-141-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/1060-64-0x0000000007AF0000-0x0000000007B01000-memory.dmp

Download

memory/1060-63-0x00000000077F0000-0x0000000007893000-memory.dmp

Download

memory/1060-45-0x0000000005F70000-0x00000000062C4000-memory.dmp

Download

memory/1060-54-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/1060-55-0x0000000070E00000-0x0000000071154000-memory.dmp

Download

memory/1060-53-0x0000000006B50000-0x0000000006B9C000-memory.dmp

Download

memory/1060-65-0x0000000007B40000-0x0000000007B54000-memory.dmp

Download

memory/1248-221-0x0000000007600000-0x0000000007611000-memory.dmp

Download

memory/1248-212-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/1248-222-0x0000000005940000-0x0000000005954000-memory.dmp

Download

memory/1248-211-0x00000000704E0000-0x000000007052C000-memory.dmp

Download

memory/1248-220-0x0000000007480000-0x0000000007523000-memory.dmp

Download

memory/1544-244-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/1544-253-0x00000000063B0000-0x00000000063C4000-memory.dmp

Download

memory/1544-243-0x00000000704E0000-0x000000007052C000-memory.dmp

Download

memory/1544-252-0x0000000007B30000-0x0000000007B41000-memory.dmp

Download

memory/1844-22-0x0000000007270000-0x00000000072A2000-memory.dmp

Download

memory/1844-17-0x0000000006E60000-0x0000000006EA4000-memory.dmp

Download

memory/1844-37-0x00000000074D0000-0x0000000007566000-memory.dmp

Download

memory/1844-36-0x00000000073C0000-0x00000000073CA000-memory.dmp

Download

memory/1844-35-0x00000000072D0000-0x0000000007373000-memory.dmp

Download

memory/1844-1-0x0000000004710000-0x0000000004746000-memory.dmp

Download

memory/1844-24-0x00000000706E0000-0x0000000070A34000-memory.dmp

Download

memory/1844-2-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/1844-3-0x0000000004DC0000-0x00000000053E8000-memory.dmp

Download

memory/1844-32-0x00000000072B0000-0x00000000072CE000-memory.dmp

Download

memory/1844-33-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/1844-39-0x0000000007410000-0x000000000741E000-memory.dmp

Download

memory/1844-34-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/1844-23-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/1844-40-0x0000000007430000-0x0000000007444000-memory.dmp

Download

memory/1844-42-0x0000000007470000-0x0000000007478000-memory.dmp

Download

memory/1844-38-0x00000000073D0000-0x00000000073E1000-memory.dmp

Download

memory/1844-4-0x0000000004D20000-0x0000000004D42000-memory.dmp

Download

memory/1844-21-0x000000007F320000-0x000000007F330000-memory.dmp

Download

memory/1844-20-0x0000000007030000-0x000000000704A000-memory.dmp

Download

memory/1844-5-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/1844-19-0x0000000007750000-0x0000000007DCA000-memory.dmp

Download

memory/1844-18-0x0000000007050000-0x00000000070C6000-memory.dmp

Download

memory/1844-6-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/1844-0-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/1844-41-0x0000000007480000-0x000000000749A000-memory.dmp

Download

memory/1844-16-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Download

memory/1844-15-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Download

memory/1844-14-0x0000000005860000-0x0000000005BB4000-memory.dmp

Download

memory/3156-224-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/3156-223-0x00000000704E0000-0x000000007052C000-memory.dmp

Download

memory/3156-234-0x00000000072C0000-0x00000000072D1000-memory.dmp

Download

memory/4316-97-0x00000000707E0000-0x0000000070B34000-memory.dmp

Download

memory/4316-96-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/4316-94-0x0000000006530000-0x0000000006884000-memory.dmp

Download

memory/4352-171-0x00000000704E0000-0x000000007052C000-memory.dmp

Download

memory/4352-181-0x0000000007030000-0x00000000070D3000-memory.dmp

Download

memory/4352-172-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/4352-169-0x0000000006320000-0x000000000636C000-memory.dmp

Download

memory/4368-149-0x00000000066B0000-0x00000000066C1000-memory.dmp

Download

memory/4368-139-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Download

memory/4368-131-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/4368-130-0x00000000705C0000-0x000000007060C000-memory.dmp

Download

memory/4368-129-0x0000000006990000-0x00000000069DC000-memory.dmp

Download

memory/4368-112-0x0000000006170000-0x00000000064C4000-memory.dmp

Download

memory/5064-78-0x0000000070E00000-0x0000000071154000-memory.dmp

Download

memory/5064-77-0x0000000070660000-0x00000000706AC000-memory.dmp

Download