glupteba | 6aff74b947b1221353d631fd11d218527f9613fd7735a6f13a706156fedf2bc5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp7ybsnp4h.exe
Size 9.1MB
Sample260602-mf9csacs6n
SHA256 6aff74b947b1221353d631fd11d218527f9613fd7735a6f13a706156fedf2bc5
MD5 c3e1d1a09eea71992d4dab6fc1667d8e
SHA1 939610fbfa7cab916f67a3dfab559e002d66a709
SHA512 7b87bed98f12ee4c03bd629370ac23c21f5a5d1f477b495018a716f2afb99dae1755a30508150f09ad3f089ffc89551e45a413878c44a97f606fae00d24e3a16
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfdhZytTD5iqmm:sxEvYjVzAN1hwNt
TLSH
T1D6A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001500000002b041-99.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2924	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
5624	csrss.exe
5876	csrss.exe
2792	csrss.exe
6124	csrss.exe
1648	csrss.exe
676	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmp7ybsnp4h.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmp7ybsnp4h.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmp7ybsnp4h.exe
File created	C:\Windows\rss\csrss.exe	tmp7ybsnp4h.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
2812	powershell.exe
3600	powershell.exe
568	powershell.exe
2252	powershell.exe
5900	powershell.exe
1020	powershell.exe
1208	powershell.exe
1272	powershell.exe
4056	powershell.exe
2532	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7ybsnp4h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7ybsnp4h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6080	schtasks.exe
2504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	powershell.exe
2944	powershell.exe
4396	tmp7ybsnp4h.exe
4396	tmp7ybsnp4h.exe
2812	powershell.exe
2812	powershell.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
1508	tmp7ybsnp4h.exe
3600	powershell.exe
3600	powershell.exe
568	powershell.exe
568	powershell.exe
2252	powershell.exe
2252	powershell.exe
1208	powershell.exe
1208	powershell.exe
5900	powershell.exe
5900	powershell.exe
5876	csrss.exe
5876	csrss.exe
1272	powershell.exe
1272	powershell.exe
4056	powershell.exe
4056	powershell.exe
1020	powershell.exe
1020	powershell.exe
6124	csrss.exe
6124	csrss.exe
2532	powershell.exe
2532	powershell.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
5624	csrss.exe
5624	csrss.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
5624	csrss.exe
5624	csrss.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe
676	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	4396	tmp7ybsnp4h.exe
Token: SeImpersonatePrivilege	4396	tmp7ybsnp4h.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	5876	csrss.exe
Token: SeImpersonatePrivilege	5876	csrss.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	6124	csrss.exe
Token: SeImpersonatePrivilege	6124	csrss.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeSystemEnvironmentPrivilege	5624	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2944	4396	tmp7ybsnp4h.exe	82
PID 1508 wrote to memory of 2812	1508	tmp7ybsnp4h.exe	87
PID 1508 wrote to memory of 5160	1508	tmp7ybsnp4h.exe	89
PID 5160 wrote to memory of 2924	5160	cmd.exe	91
PID 1508 wrote to memory of 3600	1508	tmp7ybsnp4h.exe	92
PID 1508 wrote to memory of 568	1508	tmp7ybsnp4h.exe	94
PID 1508 wrote to memory of 5624	1508	tmp7ybsnp4h.exe	96
PID 5624 wrote to memory of 2252	5624	csrss.exe	97
PID 5876 wrote to memory of 1208	5876	csrss.exe	101
PID 5624 wrote to memory of 5900	5624	csrss.exe	113
PID 2792 wrote to memory of 1272	2792	csrss.exe	118
PID 6124 wrote to memory of 4056	6124	csrss.exe	120
PID 5624 wrote to memory of 1020	5624	csrss.exe	122
PID 1648 wrote to memory of 2532	1648	csrss.exe	125
PID 5624 wrote to memory of 676	5624	csrss.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp7ybsnp4h.exe
"C:\Users\Admin\AppData\Local\Temp\tmp7ybsnp4h.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\tmp7ybsnp4h.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7ybsnp4h.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2252
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6080
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5900
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:676
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1272

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 30bbd98cab787aab1f903cd488bc05cabf9e59554ae2a2e91249255baecf8636
MD5 e7d9348f9ef84948d08d0df5c895813e
SHA1 8348cf2af0e5b2be9e262bb83bd8cef5a2ab0249
SHA512 2ce55d64d6767125d67debd24250fed4c77b5ea3143817851908d1ed83fe81c715c9bd0808b43dd24af248709e0b098213076a8c3a05a23de1904b1a0670daff
SSDEEP 384:eL3HhwtSS1I2WktHOe7FRH2eBHnnN/jQGIZGLj53sUjsNKyEIDniJQLOj99Fy:ox8SSPTHOERPFN/jfIZGL93xsNh9Dnis
TLSH
T16F92D5AE711F26C3C89563B8D10A000FE8F2DE8D031956DDB72E8F7B89AC99E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 d5fbf9677412012235e167d9d859a50cea48f6e05d2cdba532893143cbc0ebb4
MD5 7250d489ef67c2be93ade489f8477812
SHA1 15505aacea2d324cc33c4a54dfed09dddfea5a9d
SHA512 2a25f5ac456f427e79fb4c9b1e016f670c552075641d748eb83036b86d743f707dde89d51f7baf0b8e57e0eeef6a1147ae3f90198427ef315a11efb1b1b19bd6
SSDEEP 384:uTHhwz1SSpf9rvkFRHEMEuPZcd/NCa1k2hZ5Vdq4GexyM9iWxLnnY9phAUd5H:YISSBZkRPEr7Ca13hZ5Vw8NiWlY9p2UT
TLSH
T183922A6D625F2AC7E86623F8C0260B8FF5F18ADDC34456DE6344993B06DE66044BC6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_shmkruzw.5hi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_shmkruzw.5hi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 92ad58f8fd26d2012511d1b8179c30a19c3357f1f8a15d1deb4e0e87a30b63d6
MD5 ef362d3614d69097fa1567f49797963b
SHA1 b8e6c4d0748bffd81a2b88db794049ea8ea96838
SHA512 d57c1ceba3da47294c416a2ae83d492755350599dd215c2dbdd1286b9f4893176ee90b311f91e70b5be7b3b49c7f3a2827dcaa85f369955b405865fff1edfb5d
SSDEEP 384:LL3HhpS2ILjVWRU52MHeHnN7jWaK2OLNeo5ZbW6iynY9jhUdkH:/vSvYRfN7jWaBOLNL5ZbW6id9lU0
TLSH
T18E92395D225F269BE4A513F4D026078BFAF09EDEC30463EE63166C3B05CE67594A84EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 61346377a19a0839c7f9b717ea490a2cbfd051e47855005dee320c3afd388734
MD5 bd6682200c75fec3cdc14ae37f976bd8
SHA1 dc2c709ba85efa86c615cdc834d5a09db7bed42a
SHA512 6012dfb2427b21eeeff3e0255139c4cb2f5ec1279ac6236314b9a4b784325485360d568f34d25596aef0a77740e0d13dae6cfdce4610d65143825ee775c9a8e7
SSDEEP 384:XTHhpSStotkBIc60RBVIOu/nSjFK2OLNeU+bWXUD/nY9jhUd9H:bSSZCcbR4vSjFBOLNt+bWkDA9lUr
TLSH
T1679218A9226F26DBC4A513B8D016478BF5F09EDF834057DE63195D3B0ACF66180AC5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 0b6c135e82d28e6350cf88c51ef08deb0e810c74bb954f4a1d97691a7e9e7cea
MD5 200c5745c9121fe58c0e08ccbb03eb56
SHA1 3aec9bcab995b085aa9b51874fba7d8f065f1339
SHA512 7001953115738ea27fc83546fca2c42e5d838aff7e9beafffcf78a39f385220ca339d865e87809e72728d6b88c845b94868f9a63701758b375cb91c2ea91d0b4
SSDEEP 384:nL3HhwSStov6XAGFRHEMaULnnNjWaK24NXjC/4bPyLenY9jhUdxH:LKSS5QGRPa0NjWaB4NzvbqLB9lU/
TLSH
T1F09229AD226F229BC4A523F49422079BECF09ECF438457DE67189D3B05CA67184A85FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d91b3117ecf74bcfce194b80621a5972a9d1ef1ca19e5ee4c69735a64a1611a2
MD5 50f4c9a346abbd1ac11179a9c5040282
SHA1 37e5d326e6d3d0a7de930233afa4a67dce505dbe
SHA512 2576efa3d36d3cae709b61152829952a7b9b37f959b5a68385e193d57823fe993c067806ea236db357c61fb7fcffc1cc20fb96b1961462519864a1dee30a0458
SSDEEP 384:cTHhz1S2krMcJ6FRTaBH+H4cznNOaK2QFbAmOz/nY9jhUd9H:GS3n6RmB+TxOaBQgzA9lUr
TLSH
T14492296D226F26A7D46563B8D02607CBF9F09ECEC340D3DE17064C3A05CB66184A96FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 793B
SHA256 37d9cac2141e5b202eca8e7d0df5bf1a53d97294580c461e6609d17f0eb8dbdc
MD5 f2f5215051d3f36e2a6c3f3d07a9e480
SHA1 c1f6bc77a49e8619b31ff544b5ca9f62f9847a58
SHA512 e885f0a592f0f6f5d8c8a79134f9ddcaf4dca1193eae41c0a88013c34bc88834c2bfcf15ae7a517929e3f4ecd86d42b4f036ecec983ba3ab7d86b40aa4decb08
TLSH
T1B5019972F34CC439C8D5027A18C8FA167A35D3C74096DE8F3A84C128EE57886CBB43A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 befb044becda32ba1c4d24d9d10e4bb49a2bf5367a4abc35c8aa094d3c43a9fe
MD5 dea2cce1763a8f1f00eb77910b0688a4
SHA1 411c14ff1476f76b1ce78a4062380af49e075225
SHA512 62df85a0574fb580ed597f2bb71305e6d9a8dc7cb44e8a5e3ab2e0cc54f5a7e65988b046e98b464d934848cb903e795a86846c6a27d147be0c24cf867b001ac7
SSDEEP 384:VTHhtKSJgeBpecIFOHSgnN/jQGILs+NXjg2x+bzHfzpRjN+dF+:NKSWcIFuSu/jfILs+Nzgy+bz/zpOdk
TLSH
T1E292E6AE711F16C3C88553B8D20A050FE8F2DE8D031952D9BB2E8F7B8DAC65E913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 9b5e8dae5bd1b3831a9ca3dd56e599101caf2f4f1aaad95e45b3e2cc35ea3582
MD5 6be4bfb43e8f3c9ae120e70b521e4f68
SHA1 3edba47f09d74ba88f6c05153c00276dacc7920f
SHA512 f6efef0310d2fb3dd963f3ad942d1d0698014f08616f3c4afe0e80d44afe02d8995bc36b6c97086681e4127050a9c75d3d29897e240e0aac0d76678218d299db
SSDEEP 384:rL3HhtS2tXUY1IGRGyAMNOHb6HnHtjWaK2OLNX2/4bmbynY9jhUdkH:frS8TJRGeAKNjWaBOLNDbmbd9lU0
TLSH
T16E922959326F269AF4A213F8C0221B8BFDF089CFC34456DE5755A93B01CB67184E95F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 6aff74b947b1221353d631fd11d218527f9613fd7735a6f13a706156fedf2bc5
MD5 c3e1d1a09eea71992d4dab6fc1667d8e
SHA1 939610fbfa7cab916f67a3dfab559e002d66a709
SHA512 7b87bed98f12ee4c03bd629370ac23c21f5a5d1f477b495018a716f2afb99dae1755a30508150f09ad3f089ffc89551e45a413878c44a97f606fae00d24e3a16
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfdhZytTD5iqmm:sxEvYjVzAN1hwNt
TLSH
T1D6A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-88-0x0000000070C90000-0x0000000070CDC000-memory.dmp

Download

memory/568-89-0x0000000070E10000-0x0000000071167000-memory.dmp

Download

memory/1020-211-0x0000000006180000-0x0000000006195000-memory.dmp

Download

memory/1020-201-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/1020-202-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/1208-129-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/1208-130-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/1208-139-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/1272-174-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/1272-175-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/2252-108-0x0000000005E60000-0x00000000061B7000-memory.dmp

Download

memory/2252-128-0x0000000007A10000-0x0000000007A21000-memory.dmp

Download

memory/2252-120-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/2252-127-0x0000000007690000-0x0000000007734000-memory.dmp

Download

memory/2252-137-0x0000000006220000-0x0000000006235000-memory.dmp

Download

memory/2252-111-0x0000000006980000-0x00000000069CC000-memory.dmp

Download

memory/2252-119-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/2532-221-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/2532-233-0x0000000005970000-0x0000000005985000-memory.dmp

Download

memory/2532-220-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/2532-228-0x0000000007120000-0x0000000007131000-memory.dmp

Download

memory/2812-59-0x00000000073F0000-0x0000000007401000-memory.dmp

Download

memory/2812-48-0x0000000005A40000-0x0000000005D97000-memory.dmp

Download

memory/2812-58-0x00000000070D0000-0x0000000007174000-memory.dmp

Download

memory/2812-51-0x0000000070E10000-0x0000000071167000-memory.dmp

Download

memory/2812-60-0x0000000007440000-0x0000000007455000-memory.dmp

Download

memory/2812-50-0x0000000070C90000-0x0000000070CDC000-memory.dmp

Download

memory/2812-49-0x0000000005F20000-0x0000000005F6C000-memory.dmp

Download

memory/2944-26-0x00000000074A0000-0x00000000074BE000-memory.dmp

Download

memory/2944-30-0x00000000074C0000-0x0000000007564000-memory.dmp

Download

memory/2944-38-0x0000000007700000-0x000000000771A000-memory.dmp

Download

memory/2944-37-0x00000000076B0000-0x00000000076C5000-memory.dmp

Download

memory/2944-36-0x00000000076A0000-0x00000000076AE000-memory.dmp

Download

memory/2944-35-0x0000000007650000-0x0000000007661000-memory.dmp

Download

memory/2944-34-0x0000000007740000-0x00000000077D6000-memory.dmp

Download

memory/2944-33-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/2944-32-0x00000000075F0000-0x000000000760A000-memory.dmp

Download

memory/2944-31-0x0000000007C30000-0x00000000082AA000-memory.dmp

Download

memory/2944-0-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Download

memory/2944-27-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Download

memory/2944-29-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Download

memory/2944-39-0x00000000076F0000-0x00000000076F8000-memory.dmp

Download

memory/2944-28-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Download

memory/2944-18-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/2944-19-0x0000000070D00000-0x0000000071057000-memory.dmp

Download

memory/2944-17-0x0000000007460000-0x0000000007494000-memory.dmp

Download

memory/2944-16-0x000000007F110000-0x000000007F120000-memory.dmp

Download

memory/2944-15-0x00000000065B0000-0x00000000065F6000-memory.dmp

Download

memory/2944-14-0x0000000006080000-0x00000000060CC000-memory.dmp

Download

memory/2944-13-0x0000000006030000-0x000000000604E000-memory.dmp

Download

memory/2944-12-0x0000000005B60000-0x0000000005EB7000-memory.dmp

Download

memory/2944-5-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/2944-4-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/2944-3-0x0000000005170000-0x0000000005192000-memory.dmp

Download

memory/2944-2-0x00000000052F0000-0x000000000591A000-memory.dmp

Download

memory/2944-1-0x0000000002B50000-0x0000000002B86000-memory.dmp

Download

memory/3600-72-0x0000000070C90000-0x0000000070CDC000-memory.dmp

Download

memory/3600-73-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/3600-70-0x00000000059E0000-0x0000000005D37000-memory.dmp

Download

memory/4056-200-0x0000000005990000-0x00000000059A5000-memory.dmp

Download

memory/4056-199-0x0000000005950000-0x0000000005961000-memory.dmp

Download

memory/4056-190-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/4056-191-0x0000000071530000-0x0000000071887000-memory.dmp

Download

memory/5900-172-0x0000000005B40000-0x0000000005B55000-memory.dmp

Download

memory/5900-165-0x0000000007170000-0x0000000007181000-memory.dmp

Download

memory/5900-150-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/5900-158-0x0000000006FC0000-0x0000000007064000-memory.dmp

Download

memory/5900-151-0x0000000071530000-0x0000000071887000-memory.dmp

Download