Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 20:05

General

  • Target

    faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7.exe

  • Size

    4.2MB

  • MD5

    3b87f8fb16ff450f7c563ae9a3ac9377

  • SHA1

    88430ed4d7d7f094b72c39e358b54514fccbc64d

  • SHA256

    faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7

  • SHA512

    59d7562e832f9571dd3508a66c2c07b3162705757b780a5d4b5d76104d45dd2e7d5ddbc1e615d06dba989d7dcdab3b4ef4ced24daae703fed80da03f468b02f6

  • SSDEEP

    98304:zUz34gHK7L+1pSUFiDEw1wHudwMFKo10eGOWTguq125RLA:A4KJpjMx1wHudZFf7MqY52

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7.exe
    "C:\Users\Admin\AppData\Local\Temp\faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1944
    • C:\Users\Admin\AppData\Local\Temp\faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7.exe
      "C:\Users\Admin\AppData\Local\Temp\faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:740
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4956
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4236
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3316
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1156
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2736
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:2752
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:228
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4104
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1148
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2140
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3204
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:5004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 944
        2⤵
        • Program crash
        PID:2488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3156 -ip 3156
      1⤵
        PID:4760
      • C:\Windows\windefender.exe
        C:\Windows\windefender.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:2988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zi3wdf1l.bhu.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

        Filesize

        281KB

        MD5

        d98e33b66343e7c96158444127a117f6

        SHA1

        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

        SHA256

        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

        SHA512

        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

        Filesize

        281KB

        MD5

        d98e33b66343e7c96158444127a117f6

        SHA1

        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

        SHA256

        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

        SHA512

        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        f36f67c3db2058f77bdc10ef8a652e9e

        SHA1

        ca17b46e43276438867edc17dd3168d0fe928aef

        SHA256

        4822121100987209a737a385b348b687c51d8676a5e4b2bb32fc576a61f9a734

        SHA512

        e3dc17451c1e9af93e984e19bf6ea4926243c9054527d06024f0d6da23419dd6fc1d7c5c5533cbe0bbf073763cef52355b394c1f2ee0c792b8de1e8018e64b24

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        ddf32e48d596faa40417055de48c6445

        SHA1

        7e254aa014195116bad3ed5619fd7e97a46a4183

        SHA256

        262574b1a18bb6806f020048cab458641533d6faf87d0b783e5f5c940afb73bd

        SHA512

        5687d320f575b36f3f110e44220986995f6b17f3e4aaaa74f12c20e8b1d2966f9cbbda4ecde3a6980a16d657e4f23a85fd8d1101248c63b38d927e5fd894bc43

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        8bf715283c498d6c8a6855e671c8618c

        SHA1

        0daac5710899e8186ac7429698afc2daeb013210

        SHA256

        6fd045d8e54f32a5cefb32d49a124855c24180adc8003b305f4bdfe71ea005bc

        SHA512

        92e8297488c94ff5a1d062fe67bcfd1ab557f14addd5d20f69debe7846575be81063b8b07cdda1203e60bc3148c46191ce0f8b71c701be958960296fd5b94956

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        343ef9b25f367e750ea172908e251f08

        SHA1

        98118b7a33721f81b4a23a4dc46d86ea2bbcde47

        SHA256

        be4f824bc326722329669351f3c591c5bfc6a221e1b01679f779378b7686d6a5

        SHA512

        94bdae02a5447835d3743d1354c731733d604c12340787df430f8964dbca7a5d67e1aa3b308622447ac9ccbab8b1c704621c9ea477b73d15fcca06cdb2ad3615

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        9dbc6911d93e6ffbf4259a2dad3e9b26

        SHA1

        05f3f8f2170f8d614798292dcec9ed914ffc3ff5

        SHA256

        069578e28b6ae87f009181a6d907528d5fd3105dbe91c8c684bfc91327ec5136

        SHA512

        b5c5b7ad47c142bb6530dad1be0ce3e522c4fe66b7e6a55175b9c374ee9d1247f7e3f00189824ab6261a82c18d83131aedfd9754c6c98c0450e8dcb2d574bb67

      • C:\Windows\rss\csrss.exe

        Filesize

        4.2MB

        MD5

        3b87f8fb16ff450f7c563ae9a3ac9377

        SHA1

        88430ed4d7d7f094b72c39e358b54514fccbc64d

        SHA256

        faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7

        SHA512

        59d7562e832f9571dd3508a66c2c07b3162705757b780a5d4b5d76104d45dd2e7d5ddbc1e615d06dba989d7dcdab3b4ef4ced24daae703fed80da03f468b02f6

      • C:\Windows\rss\csrss.exe

        Filesize

        4.2MB

        MD5

        3b87f8fb16ff450f7c563ae9a3ac9377

        SHA1

        88430ed4d7d7f094b72c39e358b54514fccbc64d

        SHA256

        faacdb3451257b019aa66e8fd66e72a012f9e45bdc19bfc8db9779a44e3e1ae7

        SHA512

        59d7562e832f9571dd3508a66c2c07b3162705757b780a5d4b5d76104d45dd2e7d5ddbc1e615d06dba989d7dcdab3b4ef4ced24daae703fed80da03f468b02f6

      • C:\Windows\windefender.exe

        Filesize

        2.0MB

        MD5

        8e67f58837092385dcf01e8a2b4f5783

        SHA1

        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

        SHA256

        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

        SHA512

        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

      • C:\Windows\windefender.exe

        Filesize

        2.0MB

        MD5

        8e67f58837092385dcf01e8a2b4f5783

        SHA1

        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

        SHA256

        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

        SHA512

        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

      • C:\Windows\windefender.exe

        Filesize

        2.0MB

        MD5

        8e67f58837092385dcf01e8a2b4f5783

        SHA1

        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

        SHA256

        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

        SHA512

        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

      • memory/740-80-0x000000007F220000-0x000000007F230000-memory.dmp

        Filesize

        64KB

      • memory/740-63-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/740-98-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/740-95-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/740-94-0x0000000007470000-0x0000000007484000-memory.dmp

        Filesize

        80KB

      • memory/740-93-0x0000000007400000-0x0000000007411000-memory.dmp

        Filesize

        68KB

      • memory/740-91-0x0000000006F10000-0x0000000006FB3000-memory.dmp

        Filesize

        652KB

      • memory/740-81-0x00000000714B0000-0x0000000071804000-memory.dmp

        Filesize

        3.3MB

      • memory/740-79-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

        Filesize

        304KB

      • memory/740-77-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

        Filesize

        64KB

      • memory/740-76-0x00000000062C0000-0x000000000630C000-memory.dmp

        Filesize

        304KB

      • memory/740-71-0x0000000005880000-0x0000000005BD4000-memory.dmp

        Filesize

        3.3MB

      • memory/740-65-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

        Filesize

        64KB

      • memory/740-64-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

        Filesize

        64KB

      • memory/1072-163-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/1072-59-0x00000000043A0000-0x00000000047A1000-memory.dmp

        Filesize

        4.0MB

      • memory/1072-115-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/1072-160-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/1072-92-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/1072-78-0x00000000043A0000-0x00000000047A1000-memory.dmp

        Filesize

        4.0MB

      • memory/1072-61-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/1700-279-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/1944-34-0x0000000071170000-0x00000000714C4000-memory.dmp

        Filesize

        3.3MB

      • memory/1944-31-0x000000007F530000-0x000000007F540000-memory.dmp

        Filesize

        64KB

      • memory/1944-54-0x0000000007E30000-0x0000000007E38000-memory.dmp

        Filesize

        32KB

      • memory/1944-21-0x0000000006110000-0x0000000006464000-memory.dmp

        Filesize

        3.3MB

      • memory/1944-53-0x0000000002D30000-0x0000000002D40000-memory.dmp

        Filesize

        64KB

      • memory/1944-46-0x0000000007D80000-0x0000000007D8A000-memory.dmp

        Filesize

        40KB

      • memory/1944-45-0x0000000007C70000-0x0000000007D13000-memory.dmp

        Filesize

        652KB

      • memory/1944-44-0x0000000007C10000-0x0000000007C2E000-memory.dmp

        Filesize

        120KB

      • memory/1944-52-0x0000000007EE0000-0x0000000007EFA000-memory.dmp

        Filesize

        104KB

      • memory/1944-33-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

        Filesize

        304KB

      • memory/1944-10-0x0000000005FC0000-0x0000000006026000-memory.dmp

        Filesize

        408KB

      • memory/1944-32-0x0000000007C30000-0x0000000007C62000-memory.dmp

        Filesize

        200KB

      • memory/1944-29-0x0000000008150000-0x00000000087CA000-memory.dmp

        Filesize

        6.5MB

      • memory/1944-16-0x00000000060A0000-0x0000000006106000-memory.dmp

        Filesize

        408KB

      • memory/1944-30-0x00000000077F0000-0x000000000780A000-memory.dmp

        Filesize

        104KB

      • memory/1944-57-0x0000000074D50000-0x0000000075500000-memory.dmp

        Filesize

        7.7MB

      • memory/1944-51-0x0000000007DF0000-0x0000000007E04000-memory.dmp

        Filesize

        80KB

      • memory/1944-28-0x0000000007850000-0x00000000078C6000-memory.dmp

        Filesize

        472KB

      • memory/1944-27-0x0000000002D30000-0x0000000002D40000-memory.dmp

        Filesize

        64KB

      • memory/1944-26-0x0000000006AB0000-0x0000000006AF4000-memory.dmp

        Filesize

        272KB

      • memory/1944-25-0x0000000006700000-0x000000000674C000-memory.dmp

        Filesize

        304KB

      • memory/1944-50-0x0000000007DE0000-0x0000000007DEE000-memory.dmp

        Filesize

        56KB

      • memory/1944-4-0x0000000074D50000-0x0000000075500000-memory.dmp

        Filesize

        7.7MB

      • memory/1944-5-0x0000000002D30000-0x0000000002D40000-memory.dmp

        Filesize

        64KB

      • memory/1944-6-0x0000000005130000-0x0000000005166000-memory.dmp

        Filesize

        216KB

      • memory/1944-7-0x00000000057A0000-0x0000000005DC8000-memory.dmp

        Filesize

        6.2MB

      • memory/1944-47-0x0000000007E40000-0x0000000007ED6000-memory.dmp

        Filesize

        600KB

      • memory/1944-9-0x00000000056C0000-0x00000000056E2000-memory.dmp

        Filesize

        136KB

      • memory/1944-24-0x00000000066B0000-0x00000000066CE000-memory.dmp

        Filesize

        120KB

      • memory/1944-49-0x0000000074D50000-0x0000000075500000-memory.dmp

        Filesize

        7.7MB

      • memory/1944-48-0x0000000007DA0000-0x0000000007DB1000-memory.dmp

        Filesize

        68KB

      • memory/2988-287-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/2988-281-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/3156-8-0x0000000004500000-0x0000000004908000-memory.dmp

        Filesize

        4.0MB

      • memory/3156-22-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/3156-60-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/3156-1-0x0000000004500000-0x0000000004908000-memory.dmp

        Filesize

        4.0MB

      • memory/3156-23-0x0000000004910000-0x00000000051FB000-memory.dmp

        Filesize

        8.9MB

      • memory/3156-2-0x0000000004910000-0x00000000051FB000-memory.dmp

        Filesize

        8.9MB

      • memory/3156-3-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/3316-130-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/3316-131-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

        Filesize

        64KB

      • memory/4236-114-0x0000000005140000-0x0000000005150000-memory.dmp

        Filesize

        64KB

      • memory/4236-116-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

        Filesize

        304KB

      • memory/4236-129-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4236-102-0x0000000005140000-0x0000000005150000-memory.dmp

        Filesize

        64KB

      • memory/4236-101-0x0000000005140000-0x0000000005150000-memory.dmp

        Filesize

        64KB

      • memory/4236-112-0x0000000005F00000-0x0000000006254000-memory.dmp

        Filesize

        3.3MB

      • memory/4236-127-0x000000007F890000-0x000000007F8A0000-memory.dmp

        Filesize

        64KB

      • memory/4236-117-0x00000000712C0000-0x0000000071614000-memory.dmp

        Filesize

        3.3MB

      • memory/4236-100-0x0000000074DF0000-0x00000000755A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4472-269-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-198-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-271-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-280-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-270-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-282-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-284-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-286-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB

      • memory/4472-249-0x0000000000400000-0x0000000002675000-memory.dmp

        Filesize

        34.5MB