Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-1703_x64
  • resource
    win10-20230831-en
  • resource tags

    arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/10/2023, 08:40

General

  • Target

    decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193.exe

  • Size

    4.1MB

  • MD5

    57045d9cf270b4282971661f34627237

  • SHA1

    7f8c8b0536a5c8c77d2920b673b9302cc18fce8f

  • SHA256

    decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193

  • SHA512

    af544b2dbf8e3f06b535906cc99662ddbec6b46fbdee322030042526ad764e41435d453a69c2507b19956b5de7500950abfa570b18fc2a9c077b720f20967108

  • SSDEEP

    98304:+wp3cro0iZyioDMfdJPL9iMgeqX6DM3uix03Z9L4v35QOR:+MkunoDMfdJPL3geqMM3xGHLi5QQ

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 21 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193.exe
    "C:\Users\Admin\AppData\Local\Temp\decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3224
    • C:\Users\Admin\AppData\Local\Temp\decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193.exe
      "C:\Users\Admin\AppData\Local\Temp\decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Modifies data under HKEY_USERS
          PID:3732
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3904
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:316
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4380
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3456
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4728
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3224
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2244
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:780
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3864
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2696
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4904
          • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
            4⤵
            • Executes dropped EXE
            PID:2660
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:5104

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcf04wc3.1pr.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

      Filesize

      3.2MB

      MD5

      f801950a962ddba14caaa44bf084b55c

      SHA1

      7cadc9076121297428442785536ba0df2d4ae996

      SHA256

      c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

      SHA512

      4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      1c19c16e21c97ed42d5beabc93391fc5

      SHA1

      8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

      SHA256

      1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

      SHA512

      7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      04d1e2ddb5a447e0c102f7c4acdedaca

      SHA1

      eded9cfd6b49523da6df5a47217d8ca9b37036fc

      SHA256

      285013d3fec340db8dfb8e4bbeeb36f20dbc49267819815d2cdb35c6827b921f

      SHA512

      ae4b9f783803624d59e38232770b09aab7d36c3fec24dba818a3c6ee6b495a9bbdfe1dd5364e6865e576c13c43521e29fb4814d8bfd3c9e468e1c828c1ed03c5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      3f8da586d24826ba3ebed87908b537aa

      SHA1

      6db8523d80e3046d90c156c331ce4abd8785236a

      SHA256

      665564c0495d25e0d552cf5b532a998279cfbda2cbd6d5b6d436689a5ab90d58

      SHA512

      27a71acdcf420ec44fef7a22763e2e5f2ca4e1ac522a14a1c0d6c647db0066515dc45bfa21bed82cfd593c71f88d1b44fec908b0dd69aae0a46aa7d13d0d3b54

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      8af6e413b3b50819221cdfb3ac233726

      SHA1

      8836c1b95ae7952422b23fd4ba6d875f468fd962

      SHA256

      caf0eab8b0ca53d3cf753224d4a125e1e23e4be153f9a28aa3859cec5832c100

      SHA512

      9e59313df23fff6022b7f85c3335f2dc98e1d347a81f430997d117f9502ac96ea5ae05cb6099df3b494afa82bd2d107a88d0e056b76e6f32cfdcdb1916e5b105

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      1c615eb60718bab455be25326620a72e

      SHA1

      f47d795d8a73d178606103b36453f63f0e92fd6e

      SHA256

      15bb3e9506110c396bb341ebb9f7c733066783fca74e4dfb6ef978c61039dd11

      SHA512

      b48e1968f6fe6a290c54ae9db0c5e3c5c66b594cf0e8797fbba9b6dea03e5401bba6d4c390464ffff579363b26ea8470b4e8e8172f81b99f366d1ff193f53c25

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      18KB

      MD5

      3b79b1c413c7aa1377a27a44e8ca6ad0

      SHA1

      313722c5ba057c92d418aff8e6b3b1fcdbb75e75

      SHA256

      23445db129730cb9d2d9056191ec783552d106a23094f86d6f959d3e3454550d

      SHA512

      fb72513a6848ba5274b320af4f15c12d0be3f06d808b605214244f1897a99b13e88dfc80178ef9d38597483fb1d13512ee721e08a906e58a371687d2fa94ff13

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      57045d9cf270b4282971661f34627237

      SHA1

      7f8c8b0536a5c8c77d2920b673b9302cc18fce8f

      SHA256

      decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193

      SHA512

      af544b2dbf8e3f06b535906cc99662ddbec6b46fbdee322030042526ad764e41435d453a69c2507b19956b5de7500950abfa570b18fc2a9c077b720f20967108

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      57045d9cf270b4282971661f34627237

      SHA1

      7f8c8b0536a5c8c77d2920b673b9302cc18fce8f

      SHA256

      decdb3e40a96dfe78fd5dfd940d37bfba4a4c5bbf4c10a283ae27e0903e90193

      SHA512

      af544b2dbf8e3f06b535906cc99662ddbec6b46fbdee322030042526ad764e41435d453a69c2507b19956b5de7500950abfa570b18fc2a9c077b720f20967108

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/316-1057-0x0000000008210000-0x0000000008560000-memory.dmp

      Filesize

      3.3MB

    • memory/316-1059-0x0000000008A20000-0x0000000008A6B000-memory.dmp

      Filesize

      300KB

    • memory/316-1056-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/316-1055-0x0000000073320000-0x0000000073A0E000-memory.dmp

      Filesize

      6.9MB

    • memory/316-1078-0x0000000070050000-0x000000007009B000-memory.dmp

      Filesize

      300KB

    • memory/316-1079-0x00000000700A0000-0x00000000703F0000-memory.dmp

      Filesize

      3.3MB

    • memory/316-1086-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/316-1084-0x0000000009C50000-0x0000000009CF5000-memory.dmp

      Filesize

      660KB

    • memory/2384-788-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/2384-307-0x0000000004D60000-0x0000000005168000-memory.dmp

      Filesize

      4.0MB

    • memory/2384-1048-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/2384-343-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/2384-326-0x0000000004D60000-0x0000000005168000-memory.dmp

      Filesize

      4.0MB

    • memory/2384-308-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/3224-80-0x000000000A600000-0x000000000A61E000-memory.dmp

      Filesize

      120KB

    • memory/3224-68-0x0000000009850000-0x00000000098C6000-memory.dmp

      Filesize

      472KB

    • memory/3224-78-0x000000006FFD0000-0x000000007001B000-memory.dmp

      Filesize

      300KB

    • memory/3224-7-0x00000000732C0000-0x00000000739AE000-memory.dmp

      Filesize

      6.9MB

    • memory/3224-285-0x000000000A7B0000-0x000000000A7B8000-memory.dmp

      Filesize

      32KB

    • memory/3224-12-0x00000000080E0000-0x0000000008146000-memory.dmp

      Filesize

      408KB

    • memory/3224-11-0x00000000078E0000-0x0000000007902000-memory.dmp

      Filesize

      136KB

    • memory/3224-15-0x0000000008360000-0x00000000086B0000-memory.dmp

      Filesize

      3.3MB

    • memory/3224-280-0x000000000A7E0000-0x000000000A7FA000-memory.dmp

      Filesize

      104KB

    • memory/3224-16-0x00000000081B0000-0x00000000081CC000-memory.dmp

      Filesize

      112KB

    • memory/3224-17-0x0000000008990000-0x00000000089DB000-memory.dmp

      Filesize

      300KB

    • memory/3224-10-0x0000000007A40000-0x0000000008068000-memory.dmp

      Filesize

      6.2MB

    • memory/3224-37-0x0000000009710000-0x000000000974C000-memory.dmp

      Filesize

      240KB

    • memory/3224-79-0x0000000070020000-0x0000000070370000-memory.dmp

      Filesize

      3.3MB

    • memory/3224-87-0x000000000A880000-0x000000000A914000-memory.dmp

      Filesize

      592KB

    • memory/3224-76-0x00000000732C0000-0x00000000739AE000-memory.dmp

      Filesize

      6.9MB

    • memory/3224-86-0x0000000007400000-0x0000000007410000-memory.dmp

      Filesize

      64KB

    • memory/3224-8-0x0000000007400000-0x0000000007410000-memory.dmp

      Filesize

      64KB

    • memory/3224-85-0x000000000A660000-0x000000000A705000-memory.dmp

      Filesize

      660KB

    • memory/3224-304-0x00000000732C0000-0x00000000739AE000-memory.dmp

      Filesize

      6.9MB

    • memory/3224-75-0x000000000A620000-0x000000000A653000-memory.dmp

      Filesize

      204KB

    • memory/3224-77-0x000000007E700000-0x000000007E710000-memory.dmp

      Filesize

      64KB

    • memory/3224-6-0x00000000051C0000-0x00000000051F6000-memory.dmp

      Filesize

      216KB

    • memory/3224-14-0x00000000082F0000-0x0000000008356000-memory.dmp

      Filesize

      408KB

    • memory/3864-1805-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3904-801-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/3904-587-0x0000000004770000-0x0000000004780000-memory.dmp

      Filesize

      64KB

    • memory/3904-561-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/3904-581-0x00000000700D0000-0x000000007011B000-memory.dmp

      Filesize

      300KB

    • memory/3904-582-0x0000000070120000-0x0000000070470000-memory.dmp

      Filesize

      3.3MB

    • memory/4132-1044-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/4132-804-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/4132-805-0x0000000008120000-0x0000000008470000-memory.dmp

      Filesize

      3.3MB

    • memory/4132-831-0x00000000073B0000-0x00000000073C0000-memory.dmp

      Filesize

      64KB

    • memory/4132-826-0x0000000070140000-0x0000000070490000-memory.dmp

      Filesize

      3.3MB

    • memory/4132-825-0x00000000700D0000-0x000000007011B000-memory.dmp

      Filesize

      300KB

    • memory/4160-345-0x0000000004560000-0x0000000004570000-memory.dmp

      Filesize

      64KB

    • memory/4160-557-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/4160-340-0x0000000009140000-0x00000000091E5000-memory.dmp

      Filesize

      660KB

    • memory/4160-335-0x0000000070120000-0x0000000070470000-memory.dmp

      Filesize

      3.3MB

    • memory/4160-334-0x000000007E490000-0x000000007E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4160-333-0x00000000700D0000-0x000000007011B000-memory.dmp

      Filesize

      300KB

    • memory/4160-313-0x00000000080D0000-0x000000000811B000-memory.dmp

      Filesize

      300KB

    • memory/4160-312-0x0000000007690000-0x00000000079E0000-memory.dmp

      Filesize

      3.3MB

    • memory/4160-309-0x00000000733C0000-0x0000000073AAE000-memory.dmp

      Filesize

      6.9MB

    • memory/4800-1051-0x0000000005100000-0x00000000054F9000-memory.dmp

      Filesize

      4.0MB

    • memory/4800-1808-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1085-0x0000000005100000-0x00000000054F9000-memory.dmp

      Filesize

      4.0MB

    • memory/4800-1824-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1570-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1816-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1814-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1797-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1052-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1812-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1810-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1283-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/4800-1806-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/5064-305-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/5064-302-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/5064-1-0x0000000004D40000-0x0000000005142000-memory.dmp

      Filesize

      4.0MB

    • memory/5064-9-0x0000000004D40000-0x0000000005142000-memory.dmp

      Filesize

      4.0MB

    • memory/5064-26-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/5064-3-0x0000000000400000-0x0000000002FB8000-memory.dmp

      Filesize

      43.7MB

    • memory/5064-2-0x0000000005150000-0x0000000005A3B000-memory.dmp

      Filesize

      8.9MB

    • memory/5064-13-0x0000000005150000-0x0000000005A3B000-memory.dmp

      Filesize

      8.9MB

    • memory/5104-1807-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/5104-1811-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/5104-1823-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB