Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 16:31

General

  • Target

    tmp.exe

  • Size

    4.1MB

  • MD5

    888a1c86f1f4db39987a66613ea87104

  • SHA1

    82e70e1434c19c9cf84be6ed963009c13a7cd2f7

  • SHA256

    6110c7a02fe334fd3cfda9a7be565b4bd3ce59661fba7b744fec1c5a8d46a229

  • SHA512

    fb083f8ba9924cf739f0f020e1989b777f5b083bbdcff45255628bf798b7269231dcb06b9266cfd2d469f81b9d880730882146cf5c663c15f0b67cabb13c9b33

  • SSDEEP

    98304:dwYpq65PX7G0lKZQA6S/odjsKFGzL17vqhAWe1eQ3l:FpH7GDt6t5E17vTWeYG

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 22 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3392
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1364
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:1892
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:216
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3380
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3888
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1056
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:8
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2732
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:912
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4660
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2764
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3172
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:2568
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 796
          3⤵
          • Program crash
          PID:3216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 624
        2⤵
        • Program crash
        PID:928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4376 -ip 4376
      1⤵
        PID:4276
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3848 -ip 3848
        1⤵
          PID:1880
        • C:\Windows\windefender.exe
          C:\Windows\windefender.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:4276

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5ugv1y3.42k.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                968cb9309758126772781b83adb8a28f

                SHA1

                8da30e71accf186b2ba11da1797cf67f8f78b47c

                SHA256

                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                SHA512

                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                ffe642c6149f28599b5d9a8edd3748b1

                SHA1

                301fc9ecc6f2bac93f355f424d6496eb121fac21

                SHA256

                3da23861bb9b21be7505953cacd70f3fb5f299a0c12daed90c224f6d34227612

                SHA512

                3a45e1f695d5dd7785fbb8747362551298cf8f12e0cff3bc294766cdb5d9d5050362be60c5b787923f9ebe6ac5d3bdad897da729d6b154468dc6ec78c79c9acf

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                42e25c84781198f941e2bc620c95697f

                SHA1

                7e97dcfd0bf298e3a2b03438732d6d54f7220b54

                SHA256

                198566510cf34825bc848c997a77062f8fe464da3bca122f82dcb680cf61271b

                SHA512

                54bef5a00bc0d255de3d4360c2492590e340172957d9b479d08376b665c065b7905fdf3a123193cbb9b1bf56aae3c138503cfa0d1ba42a85249778510cb00dfd

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                965b874f8cdb2e8a460cb5105661e853

                SHA1

                23a3205fa658c9b3bb4d79a4535848127ea6c02f

                SHA256

                258630d5080070e3bbb8475fa87b1e4fd183726722f9ed74840dd8fc4859259b

                SHA512

                6eb1eb461897fb3d2466881e8d248fd2100d263d6670cdfa2133e9c5fab806a54a6d39d2f3e087a78af55abfb4decb4fa5fdec8d60632dd179b241ee69bc9b28

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                e48fbc56997a6e947ad26b3181faf32d

                SHA1

                8a4dc8e629c5c1bc062d2ee1ea42a8166636bfc6

                SHA256

                94e34b390eb1549c5eaa24755325b02a28d610c7faa35463b882245df1cd8960

                SHA512

                24627aee5ff55c1d140d14d390cb4498fa4c69054270f91acc1ffd213bb1ed7f58c611deae5fffa7c7f5b7b288f7d36cefd6842cc1724f86212f311248a23f98

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                4e39770da142c00317ddbc17bbf49165

                SHA1

                cbfeba6e4e2f1a97710af4e082691a6e12420d1e

                SHA256

                77d3b3ebd6cda0866a71951d14113165a6738435f042d2baa13e46df6888d725

                SHA512

                2af451e378cfbb150b3643f6dab2049ab8a553ef9d8795b95e251bbc160d0df18faf6b74245e06b2aa68cd0e9ebc5d6ff89af825cdd7c44b0af123bc46fbf28e

              • C:\Windows\rss\csrss.exe

                Filesize

                1.3MB

                MD5

                08bf562937de2754855739d4dc9799e1

                SHA1

                0ceaaec3a5fee3a15be65e3dc21e2c14dbaede69

                SHA256

                fa4d8b76aa2fb591efa31563507b850f29047698788ff16ef178a19a7478d254

                SHA512

                923e82f5e7505b7d9562021b752c79b46bbbcc163590183ee35b8d74e4e9c8469b500d4391e2a5d79561781937d773136bf2a0ab86711556317cf754425a066b

              • C:\Windows\rss\csrss.exe

                Filesize

                1.4MB

                MD5

                336cf38e724d68322089645fc9526ae2

                SHA1

                c1caaa51bd63bb1f29c91a5a4a120f676758d0fe

                SHA256

                907b5ec75a2dbad1a2a22d279b29b26fa3b2e866b5253ab382a2e501120f5773

                SHA512

                d440e6adbd248a3a922138fcc41b9a0894f9d0f8de108d10f6f3781971d29ad3980542ec90d4ab4b17ca12d89bc32b319922faedfd98b8455edf8e279650f946

              • C:\Windows\windefender.exe

                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              • memory/216-108-0x00000000706E0000-0x0000000070A34000-memory.dmp

                Filesize

                3.3MB

              • memory/216-107-0x000000007F140000-0x000000007F150000-memory.dmp

                Filesize

                64KB

              • memory/216-118-0x00000000023C0000-0x00000000023D0000-memory.dmp

                Filesize

                64KB

              • memory/216-106-0x0000000070560000-0x00000000705AC000-memory.dmp

                Filesize

                304KB

              • memory/216-121-0x0000000074660000-0x0000000074E10000-memory.dmp

                Filesize

                7.7MB

              • memory/216-103-0x00000000059A0000-0x0000000005CF4000-memory.dmp

                Filesize

                3.3MB

              • memory/216-93-0x00000000023C0000-0x00000000023D0000-memory.dmp

                Filesize

                64KB

              • memory/216-92-0x0000000074660000-0x0000000074E10000-memory.dmp

                Filesize

                7.7MB

              • memory/216-119-0x00000000023C0000-0x00000000023D0000-memory.dmp

                Filesize

                64KB

              • memory/1364-73-0x000000007FAB0000-0x000000007FAC0000-memory.dmp

                Filesize

                64KB

              • memory/1364-90-0x0000000074660000-0x0000000074E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1364-74-0x0000000070560000-0x00000000705AC000-memory.dmp

                Filesize

                304KB

              • memory/1364-72-0x0000000006400000-0x000000000644C000-memory.dmp

                Filesize

                304KB

              • memory/1364-67-0x0000000005D60000-0x00000000060B4000-memory.dmp

                Filesize

                3.3MB

              • memory/1364-61-0x0000000004F80000-0x0000000004F90000-memory.dmp

                Filesize

                64KB

              • memory/1364-60-0x0000000074660000-0x0000000074E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1364-75-0x0000000070740000-0x0000000070A94000-memory.dmp

                Filesize

                3.3MB

              • memory/1364-85-0x0000000007380000-0x0000000007423000-memory.dmp

                Filesize

                652KB

              • memory/1364-86-0x00000000078C0000-0x00000000078D1000-memory.dmp

                Filesize

                68KB

              • memory/1364-87-0x0000000007910000-0x0000000007924000-memory.dmp

                Filesize

                80KB

              • memory/2736-268-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-278-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-279-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-276-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-273-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-271-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-269-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-285-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-288-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-281-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-259-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/2736-283-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/3172-267-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/3380-138-0x0000000070560000-0x00000000705AC000-memory.dmp

                Filesize

                304KB

              • memory/3380-122-0x0000000074660000-0x0000000074E10000-memory.dmp

                Filesize

                7.7MB

              • memory/3380-131-0x0000000005730000-0x0000000005A84000-memory.dmp

                Filesize

                3.3MB

              • memory/3380-123-0x00000000049E0000-0x00000000049F0000-memory.dmp

                Filesize

                64KB

              • memory/3380-124-0x00000000049E0000-0x00000000049F0000-memory.dmp

                Filesize

                64KB

              • memory/3392-10-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                Filesize

                408KB

              • memory/3392-53-0x00000000745C0000-0x0000000074D70000-memory.dmp

                Filesize

                7.7MB

              • memory/3392-50-0x0000000007B50000-0x0000000007B58000-memory.dmp

                Filesize

                32KB

              • memory/3392-49-0x0000000007C10000-0x0000000007C2A000-memory.dmp

                Filesize

                104KB

              • memory/3392-48-0x0000000007B20000-0x0000000007B34000-memory.dmp

                Filesize

                80KB

              • memory/3392-47-0x0000000007B10000-0x0000000007B1E000-memory.dmp

                Filesize

                56KB

              • memory/3392-46-0x0000000007AD0000-0x0000000007AE1000-memory.dmp

                Filesize

                68KB

              • memory/3392-4-0x00000000745C0000-0x0000000074D70000-memory.dmp

                Filesize

                7.7MB

              • memory/3392-45-0x0000000007B70000-0x0000000007C06000-memory.dmp

                Filesize

                600KB

              • memory/3392-44-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

                Filesize

                40KB

              • memory/3392-43-0x00000000079C0000-0x0000000007A63000-memory.dmp

                Filesize

                652KB

              • memory/3392-41-0x0000000004E10000-0x0000000004E20000-memory.dmp

                Filesize

                64KB

              • memory/3392-42-0x00000000079A0000-0x00000000079BE000-memory.dmp

                Filesize

                120KB

              • memory/3392-5-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

                Filesize

                216KB

              • memory/3392-6-0x0000000004E10000-0x0000000004E20000-memory.dmp

                Filesize

                64KB

              • memory/3392-7-0x0000000004E10000-0x0000000004E20000-memory.dmp

                Filesize

                64KB

              • memory/3392-8-0x0000000005450000-0x0000000005A78000-memory.dmp

                Filesize

                6.2MB

              • memory/3392-9-0x0000000005380000-0x00000000053A2000-memory.dmp

                Filesize

                136KB

              • memory/3392-31-0x0000000070A40000-0x0000000070D94000-memory.dmp

                Filesize

                3.3MB

              • memory/3392-11-0x0000000005BF0000-0x0000000005C56000-memory.dmp

                Filesize

                408KB

              • memory/3392-29-0x0000000007960000-0x0000000007992000-memory.dmp

                Filesize

                200KB

              • memory/3392-21-0x0000000005CE0000-0x0000000006034000-memory.dmp

                Filesize

                3.3MB

              • memory/3392-30-0x0000000070460000-0x00000000704AC000-memory.dmp

                Filesize

                304KB

              • memory/3392-22-0x00000000063E0000-0x00000000063FE000-memory.dmp

                Filesize

                120KB

              • memory/3392-28-0x000000007F400000-0x000000007F410000-memory.dmp

                Filesize

                64KB

              • memory/3392-27-0x00000000077A0000-0x00000000077BA000-memory.dmp

                Filesize

                104KB

              • memory/3392-26-0x0000000007E00000-0x000000000847A000-memory.dmp

                Filesize

                6.5MB

              • memory/3392-25-0x0000000007700000-0x0000000007776000-memory.dmp

                Filesize

                472KB

              • memory/3392-24-0x0000000007530000-0x0000000007574000-memory.dmp

                Filesize

                272KB

              • memory/3392-23-0x0000000006420000-0x000000000646C000-memory.dmp

                Filesize

                304KB

              • memory/3848-58-0x0000000004560000-0x0000000004E4B000-memory.dmp

                Filesize

                8.9MB

              • memory/3848-137-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/3848-59-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/3848-105-0x0000000004150000-0x0000000004553000-memory.dmp

                Filesize

                4.0MB

              • memory/3848-125-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/3848-157-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/3848-57-0x0000000004150000-0x0000000004553000-memory.dmp

                Filesize

                4.0MB

              • memory/4276-274-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4276-270-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4376-55-0x0000000004590000-0x0000000004E7B000-memory.dmp

                Filesize

                8.9MB

              • memory/4376-1-0x0000000004180000-0x0000000004583000-memory.dmp

                Filesize

                4.0MB

              • memory/4376-54-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/4376-3-0x0000000000400000-0x00000000022E9000-memory.dmp

                Filesize

                30.9MB

              • memory/4376-2-0x0000000004590000-0x0000000004E7B000-memory.dmp

                Filesize

                8.9MB