Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-06-2023 15:44

General

  • Target

    50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e.exe

  • Size

    4.2MB

  • MD5

    7f12f4324527950f556ec9e95b621c7a

  • SHA1

    b4026e46a4b089708de7d0b10ddb68c2398a819d

  • SHA256

    50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e

  • SHA512

    2d63336b6f4e2f16f1c8bf24195767cebeae8b9df5895685209087f7ee5faf0098fa5c6fbc04db8773a1d23736313a511b67bfc52908afa4402fbaa4c466bdc6

  • SSDEEP

    98304:CwD61FoiFrV4uHNu/sjTzLLpvUtDefKLGgjrGTOuAY9606:Ct1FoixHNu/sj/LLpMtLbbule

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 16 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e.exe
    "C:\Users\Admin\AppData\Local\Temp\50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4420
    • C:\Users\Admin\AppData\Local\Temp\50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e.exe
      "C:\Users\Admin\AppData\Local\Temp\50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:384
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:164
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5004
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4828
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2756
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:496
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:416
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1240
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4568
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4280
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2644
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1296
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4228
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3476
          • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            4⤵
            • Executes dropped EXE
            PID:2652
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:748

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5nzp3w5.tcq.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      db01a2c1c7e70b2b038edf8ad5ad9826

      SHA1

      540217c647a73bad8d8a79e3a0f3998b5abd199b

      SHA256

      413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

      SHA512

      c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      de112cc7fe4a7d79dd8d093adc782b6b

      SHA1

      42f1eb1bd02ed07d479cbaf29c93f21afa50d3d9

      SHA256

      ba971b53f70c20bff88cbb59ae46ee78d8aaac624d72ebc232a027b902a124ae

      SHA512

      2247d9c3046991679c093917da4081a8acd6a6b884739220d26e67544bb93390b5b5002696734d41709c1aa1d81e66678a1919755bec43529f3f04304fe7cdd9

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      3d25c5a094fd688a1f57eea308593d16

      SHA1

      7972cb5c62debf98a42004e609add8a24459b320

      SHA256

      a7f2a439c643740bd1a677d07662cb8871452e736a77e08f3fc4f640cf4c9f5d

      SHA512

      81b6f114ab6ab536aecd089c739fd1ce154ef1d65267210296ac746e2636ef524c8194e3df945e86038b85b97d38a9aef0bcc76ec55775dae6a3489b45a246a1

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      58c98f536b89ee063c50406e27f596df

      SHA1

      a11b9f6efa17f096de22b08fe2aaa5f01d312e86

      SHA256

      4b78cb859f55f13a1bcccddcb6cf734a18a55d7a875b5d61ace4c4f1193bcd71

      SHA512

      b875c6c307287a295527a9cf1ffef4f2806a34fb991ad363997d284285e45d4ff3c76c6dde936ca7bae8a1a71972a64fd8dbbeaf5b035979bc3eade4459c1184

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      57cbda3f30eda4b89dfc08d4faeec2fe

      SHA1

      af4d8b18909b251bf80099596ac3574a82c217df

      SHA256

      0787deb6b951c5922fe44b40f539a4151152d4a1ca2c6b5a8963891a4afb707b

      SHA512

      bda0654a734a319b3bc1a0018f80c33c978f1317a0a3aa176209154bc6e7c0905b5ac5d841a954d595221be7f16c575e255142a38fcf1fe0c5efc552e2158f43

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      dcaac6d53c400455c7ed84d2286e2abc

      SHA1

      c362ac502bc7a7f4faa4de0544b53ea6009abc30

      SHA256

      36a4e514f3aaabc949ae838efa38ea3e82f1c8c91b5008b6b9591c4214a49462

      SHA512

      3f985c600036d3f53b8036a9f495df88bf4271a41a09313410a4f62ae004edd10bc9bbe706933850437357d6d492ac92a1e510f10f397c87185fb96bad8541c6

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      7f12f4324527950f556ec9e95b621c7a

      SHA1

      b4026e46a4b089708de7d0b10ddb68c2398a819d

      SHA256

      50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e

      SHA512

      2d63336b6f4e2f16f1c8bf24195767cebeae8b9df5895685209087f7ee5faf0098fa5c6fbc04db8773a1d23736313a511b67bfc52908afa4402fbaa4c466bdc6

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      7f12f4324527950f556ec9e95b621c7a

      SHA1

      b4026e46a4b089708de7d0b10ddb68c2398a819d

      SHA256

      50cab798cf8c26ecc53d7bf82945ec0d867f40226153ca9f88324bf7475f978e

      SHA512

      2d63336b6f4e2f16f1c8bf24195767cebeae8b9df5895685209087f7ee5faf0098fa5c6fbc04db8773a1d23736313a511b67bfc52908afa4402fbaa4c466bdc6

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/164-446-0x000000007F4A0000-0x000000007F4B0000-memory.dmp

      Filesize

      64KB

    • memory/164-447-0x00000000044D0000-0x00000000044E0000-memory.dmp

      Filesize

      64KB

    • memory/164-421-0x00000000044D0000-0x00000000044E0000-memory.dmp

      Filesize

      64KB

    • memory/164-422-0x0000000008220000-0x000000000826B000-memory.dmp

      Filesize

      300KB

    • memory/164-420-0x00000000044D0000-0x00000000044E0000-memory.dmp

      Filesize

      64KB

    • memory/164-419-0x0000000007970000-0x0000000007CC0000-memory.dmp

      Filesize

      3.3MB

    • memory/164-445-0x0000000009260000-0x0000000009305000-memory.dmp

      Filesize

      660KB

    • memory/384-416-0x00000000051C0000-0x0000000005AAB000-memory.dmp

      Filesize

      8.9MB

    • memory/384-924-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/384-661-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/384-1150-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/748-1902-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/748-1912-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/748-1896-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1240-1401-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/1240-1497-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/1240-1400-0x0000000004660000-0x0000000004670000-memory.dmp

      Filesize

      64KB

    • memory/1240-1402-0x0000000007800000-0x0000000007B50000-memory.dmp

      Filesize

      3.3MB

    • memory/1240-1404-0x0000000007ED0000-0x0000000007F1B000-memory.dmp

      Filesize

      300KB

    • memory/1240-1427-0x0000000009210000-0x00000000092B5000-memory.dmp

      Filesize

      660KB

    • memory/1240-1496-0x000000007E910000-0x000000007E920000-memory.dmp

      Filesize

      64KB

    • memory/1296-1895-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/2168-1899-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1901-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1661-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1913-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1905-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1397-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1903-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1897-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2168-1889-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/2652-1911-0x0000000000400000-0x0000000000C25000-memory.dmp

      Filesize

      8.1MB

    • memory/2652-1914-0x0000000000400000-0x0000000000C25000-memory.dmp

      Filesize

      8.1MB

    • memory/2756-1158-0x0000000004E40000-0x0000000004E50000-memory.dmp

      Filesize

      64KB

    • memory/2756-1182-0x0000000009770000-0x0000000009815000-memory.dmp

      Filesize

      660KB

    • memory/2756-1155-0x0000000007CC0000-0x0000000008010000-memory.dmp

      Filesize

      3.3MB

    • memory/2756-1252-0x0000000004E40000-0x0000000004E50000-memory.dmp

      Filesize

      64KB

    • memory/2756-1157-0x00000000087A0000-0x00000000087EB000-memory.dmp

      Filesize

      300KB

    • memory/2756-1159-0x0000000004E40000-0x0000000004E50000-memory.dmp

      Filesize

      64KB

    • memory/2756-1251-0x000000007E080000-0x000000007E090000-memory.dmp

      Filesize

      64KB

    • memory/3704-266-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/3704-117-0x00000000052B0000-0x0000000005B9B000-memory.dmp

      Filesize

      8.9MB

    • memory/3704-414-0x0000000000400000-0x00000000030D0000-memory.dmp

      Filesize

      44.8MB

    • memory/4420-263-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/4420-127-0x0000000007A20000-0x0000000007D70000-memory.dmp

      Filesize

      3.3MB

    • memory/4420-125-0x0000000007740000-0x00000000077A6000-memory.dmp

      Filesize

      408KB

    • memory/4420-186-0x0000000009D50000-0x0000000009D83000-memory.dmp

      Filesize

      204KB

    • memory/4420-126-0x0000000007990000-0x00000000079F6000-memory.dmp

      Filesize

      408KB

    • memory/4420-187-0x0000000009D30000-0x0000000009D4E000-memory.dmp

      Filesize

      120KB

    • memory/4420-192-0x0000000009D90000-0x0000000009E35000-memory.dmp

      Filesize

      660KB

    • memory/4420-193-0x000000007EC10000-0x000000007EC20000-memory.dmp

      Filesize

      64KB

    • memory/4420-129-0x0000000008110000-0x000000000815B000-memory.dmp

      Filesize

      300KB

    • memory/4420-148-0x0000000008380000-0x00000000083BC000-memory.dmp

      Filesize

      240KB

    • memory/4420-396-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/4420-179-0x0000000008F00000-0x0000000008F76000-memory.dmp

      Filesize

      472KB

    • memory/4420-194-0x0000000009F60000-0x0000000009FF4000-memory.dmp

      Filesize

      592KB

    • memory/4420-389-0x0000000006C90000-0x0000000006CAA000-memory.dmp

      Filesize

      104KB

    • memory/4420-394-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/4420-124-0x0000000006F20000-0x0000000006F42000-memory.dmp

      Filesize

      136KB

    • memory/4420-123-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/4420-395-0x0000000006C80000-0x0000000006C88000-memory.dmp

      Filesize

      32KB

    • memory/4420-122-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/4420-121-0x0000000007110000-0x0000000007738000-memory.dmp

      Filesize

      6.2MB

    • memory/4420-120-0x0000000000FA0000-0x0000000000FD6000-memory.dmp

      Filesize

      216KB

    • memory/4420-128-0x0000000007DD0000-0x0000000007DEC000-memory.dmp

      Filesize

      112KB

    • memory/4568-1644-0x0000000006BC0000-0x0000000006BD0000-memory.dmp

      Filesize

      64KB

    • memory/4568-1671-0x0000000006BC0000-0x0000000006BD0000-memory.dmp

      Filesize

      64KB

    • memory/4568-1670-0x000000007E9A0000-0x000000007E9B0000-memory.dmp

      Filesize

      64KB

    • memory/4568-1645-0x0000000006BC0000-0x0000000006BD0000-memory.dmp

      Filesize

      64KB

    • memory/4828-957-0x000000007F1D0000-0x000000007F1E0000-memory.dmp

      Filesize

      64KB

    • memory/4828-959-0x0000000006D00000-0x0000000006D10000-memory.dmp

      Filesize

      64KB

    • memory/4828-908-0x0000000006D00000-0x0000000006D10000-memory.dmp

      Filesize

      64KB

    • memory/4828-909-0x0000000006D00000-0x0000000006D10000-memory.dmp

      Filesize

      64KB

    • memory/5004-757-0x000000007F310000-0x000000007F320000-memory.dmp

      Filesize

      64KB

    • memory/5004-760-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/5004-667-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/5004-666-0x0000000007FE0000-0x0000000008330000-memory.dmp

      Filesize

      3.3MB

    • memory/5004-665-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB