Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 21:35

General

  • Target

    e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37.exe

  • Size

    4.1MB

  • MD5

    7c6f12c38071f811585293e811e58fb5

  • SHA1

    affd26e62e65b63ba46234859055f25c8ad74a68

  • SHA256

    e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37

  • SHA512

    94497a18a33eeb38b22cfb4dacb444d26a19a61696780189c704ed19ae8e9e27ae856fbeaee727743a934b73c422c48dd51e6865d9150c5220bea79aa1d0e630

  • SSDEEP

    98304:nZTJtvrSQI+RdfgxNOWs+luvBV3Kjpf8MTPWtsil5N:ZVJ5f9clKG+MTut9V

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37.exe
    "C:\Users\Admin\AppData\Local\Temp\e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5084
    • C:\Users\Admin\AppData\Local\Temp\e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37.exe
      "C:\Users\Admin\AppData\Local\Temp\e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2884
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:1636
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1120
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3572
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4244
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2252
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:540
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3160
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3188
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1708
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:3252
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2624
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3104
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 856
        2⤵
        • Program crash
        PID:2644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2424 -ip 2424
      1⤵
        PID:4568
      • C:\Windows\windefender.exe
        C:\Windows\windefender.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:2724

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ui0nqot.1ys.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

        Filesize

        281KB

        MD5

        d98e33b66343e7c96158444127a117f6

        SHA1

        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

        SHA256

        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

        SHA512

        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        1437e9b2f184ae086603b0aa659ad098

        SHA1

        00b4d248926a916b4844a897969084935575c3ba

        SHA256

        dbe97b53136ec6577ab834782f98060934eadf31e575b7db119cf2accc878a3a

        SHA512

        71e7eca7ac306e79387b393e4ea910db6d844594f89e484507c1c8885370c6ff1c499ce4b7cb3660b64557f2df24821ababe603ffb6a2d1d7afa5a2806466b1c

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        ff0bcad3a5947fc1312c2588c54e3515

        SHA1

        190448119ee11c9dc457232f8a92630947f54b25

        SHA256

        aa2682256e20aecca05fa5b0607fe025ecfbd437b790b0b6da0c4e44d600089c

        SHA512

        24ec7f5dceedaf57bbe93d659be6b338ecf2e96abfe56ef5cd7efe9ed279e7564fedc92a4589ecc085d53446d96f9b4bcc6a1b87e6a262eb74888d3e098d8460

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        3ddb7e3bdd7204edf549fa750866309e

        SHA1

        34be17a4d5a569fdf00f85ceaccab663430df885

        SHA256

        38fb8b370391d19b3517d5d21066d762e6a324fe37ffd4d5e3fabe4b891d81dc

        SHA512

        8b4be1bd9dfaeb558f4033552898325ee3ec3a871b3444893b089bc72fca11fd4c7651cdc82ff9fd830657a4613dd96b214fdd23a8dcfc78b438d2f339ed6ff1

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        edd5652d51d81e2d2125bbe5cad0cc62

        SHA1

        1ced6d69525fd0a4c0173b2a5683329993490f85

        SHA256

        551bd8c8e41044f3c98b62bcc9116482f1e8edb40ae33b251e50535bc7310212

        SHA512

        c89aee38d2bb67a95d017d4115d110f6e6dfc64ecac526a3149cabb99e825fd27932c7f70ff20abdc1b57df148ac89a721972e2d5ed019de9e934c38d83f6fa3

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        a5ad442f8b866a6c62ea5f58288b7748

        SHA1

        c27b225c59fb1e168bcf650b9a7a43518a5f0b87

        SHA256

        61321bb0871b2015ebe2dcc73538185556a43a94c51f7ad4d467d9f5a0e3341b

        SHA512

        249d25ccc9e5da08a2925bb29d99e1f71dddbf0205e18988f2d2d76552e6db6f67171b9216187da141c8841ffa9a82f7a42bf7d312ed733ae74c5e9de0d6280a

      • C:\Windows\rss\csrss.exe

        Filesize

        4.1MB

        MD5

        7c6f12c38071f811585293e811e58fb5

        SHA1

        affd26e62e65b63ba46234859055f25c8ad74a68

        SHA256

        e0b77eda896d4df44450996abccdbfee79d11804f428b944bffbaf40f291da37

        SHA512

        94497a18a33eeb38b22cfb4dacb444d26a19a61696780189c704ed19ae8e9e27ae856fbeaee727743a934b73c422c48dd51e6865d9150c5220bea79aa1d0e630

      • C:\Windows\windefender.exe

        Filesize

        2.0MB

        MD5

        8e67f58837092385dcf01e8a2b4f5783

        SHA1

        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

        SHA256

        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

        SHA512

        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

      • memory/1120-121-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

        Filesize

        64KB

      • memory/1120-95-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

      • memory/1120-96-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

        Filesize

        64KB

      • memory/1120-124-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

      • memory/1120-122-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

        Filesize

        64KB

      • memory/1120-106-0x00000000056D0000-0x0000000005A24000-memory.dmp

        Filesize

        3.3MB

      • memory/1120-109-0x0000000070E60000-0x0000000070EAC000-memory.dmp

        Filesize

        304KB

      • memory/1120-110-0x0000000071600000-0x0000000071954000-memory.dmp

        Filesize

        3.3MB

      • memory/1120-108-0x000000007F310000-0x000000007F320000-memory.dmp

        Filesize

        64KB

      • memory/1184-268-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-274-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-283-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-269-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-281-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-260-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-279-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-271-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-278-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1184-276-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1248-59-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1248-159-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/1248-120-0x0000000004DB0000-0x00000000051B7000-memory.dmp

        Filesize

        4.0MB

      • memory/1248-58-0x0000000004DB0000-0x00000000051B7000-memory.dmp

        Filesize

        4.0MB

      • memory/1248-138-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/2424-57-0x0000000005390000-0x0000000005C7B000-memory.dmp

        Filesize

        8.9MB

      • memory/2424-55-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/2424-1-0x0000000004F90000-0x000000000538A000-memory.dmp

        Filesize

        4.0MB

      • memory/2424-2-0x0000000005390000-0x0000000005C7B000-memory.dmp

        Filesize

        8.9MB

      • memory/2424-3-0x0000000000400000-0x0000000002F4A000-memory.dmp

        Filesize

        43.3MB

      • memory/2624-267-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/2724-280-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/2724-270-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/2724-273-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/2884-72-0x00000000058D0000-0x0000000005C24000-memory.dmp

        Filesize

        3.3MB

      • memory/2884-89-0x0000000007340000-0x0000000007351000-memory.dmp

        Filesize

        68KB

      • memory/2884-74-0x000000007F330000-0x000000007F340000-memory.dmp

        Filesize

        64KB

      • memory/2884-76-0x0000000070FE0000-0x0000000071334000-memory.dmp

        Filesize

        3.3MB

      • memory/2884-86-0x00000000027E0000-0x00000000027F0000-memory.dmp

        Filesize

        64KB

      • memory/2884-88-0x00000000027E0000-0x00000000027F0000-memory.dmp

        Filesize

        64KB

      • memory/2884-87-0x0000000007030000-0x00000000070D3000-memory.dmp

        Filesize

        652KB

      • memory/2884-75-0x0000000070E60000-0x0000000070EAC000-memory.dmp

        Filesize

        304KB

      • memory/2884-90-0x0000000007390000-0x00000000073A4000-memory.dmp

        Filesize

        80KB

      • memory/2884-93-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

      • memory/2884-73-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

        Filesize

        304KB

      • memory/2884-61-0x00000000027E0000-0x00000000027F0000-memory.dmp

        Filesize

        64KB

      • memory/2884-62-0x00000000027E0000-0x00000000027F0000-memory.dmp

        Filesize

        64KB

      • memory/2884-60-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

      • memory/3572-126-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/3572-125-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

      • memory/3572-127-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/5084-29-0x00000000073E0000-0x0000000007412000-memory.dmp

        Filesize

        200KB

      • memory/5084-27-0x0000000007230000-0x000000000724A000-memory.dmp

        Filesize

        104KB

      • memory/5084-48-0x0000000007590000-0x000000000759E000-memory.dmp

        Filesize

        56KB

      • memory/5084-47-0x0000000007550000-0x0000000007561000-memory.dmp

        Filesize

        68KB

      • memory/5084-46-0x00000000075F0000-0x0000000007686000-memory.dmp

        Filesize

        600KB

      • memory/5084-50-0x0000000007690000-0x00000000076AA000-memory.dmp

        Filesize

        104KB

      • memory/5084-45-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/5084-51-0x00000000075E0000-0x00000000075E8000-memory.dmp

        Filesize

        32KB

      • memory/5084-44-0x0000000007530000-0x000000000753A000-memory.dmp

        Filesize

        40KB

      • memory/5084-42-0x0000000007440000-0x00000000074E3000-memory.dmp

        Filesize

        652KB

      • memory/5084-43-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/5084-41-0x0000000007420000-0x000000000743E000-memory.dmp

        Filesize

        120KB

      • memory/5084-30-0x0000000070D60000-0x0000000070DAC000-memory.dmp

        Filesize

        304KB

      • memory/5084-31-0x0000000070F00000-0x0000000071254000-memory.dmp

        Filesize

        3.3MB

      • memory/5084-49-0x00000000075A0000-0x00000000075B4000-memory.dmp

        Filesize

        80KB

      • memory/5084-54-0x0000000074EC0000-0x0000000075670000-memory.dmp

        Filesize

        7.7MB

      • memory/5084-25-0x0000000006F80000-0x0000000006FF6000-memory.dmp

        Filesize

        472KB

      • memory/5084-26-0x00000000078B0000-0x0000000007F2A000-memory.dmp

        Filesize

        6.5MB

      • memory/5084-28-0x000000007EEA0000-0x000000007EEB0000-memory.dmp

        Filesize

        64KB

      • memory/5084-24-0x00000000063B0000-0x00000000063F4000-memory.dmp

        Filesize

        272KB

      • memory/5084-23-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

        Filesize

        304KB

      • memory/5084-22-0x0000000005E60000-0x0000000005E7E000-memory.dmp

        Filesize

        120KB

      • memory/5084-21-0x0000000005810000-0x0000000005B64000-memory.dmp

        Filesize

        3.3MB

      • memory/5084-10-0x0000000005670000-0x00000000056D6000-memory.dmp

        Filesize

        408KB

      • memory/5084-11-0x00000000056E0000-0x0000000005746000-memory.dmp

        Filesize

        408KB

      • memory/5084-9-0x0000000004E80000-0x0000000004EA2000-memory.dmp

        Filesize

        136KB

      • memory/5084-7-0x0000000004FD0000-0x00000000055F8000-memory.dmp

        Filesize

        6.2MB

      • memory/5084-8-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/5084-6-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/5084-4-0x0000000002860000-0x0000000002896000-memory.dmp

        Filesize

        216KB

      • memory/5084-5-0x0000000074EC0000-0x0000000075670000-memory.dmp

        Filesize

        7.7MB