Analysis

  • max time kernel
    30s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 19:13

General

  • Target

    6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027.exe

  • Size

    4.2MB

  • MD5

    8fd2b4ce721563b89d313ec0d5283d62

  • SHA1

    51d31a9e5aec6ff42c2bd0ffc041b9b170fef505

  • SHA256

    6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027

  • SHA512

    6421db81816f265452625e3b00ab368b24e4d9c8a809354df2101b08b727b12c2e63544ddf4f577732bca23a32c2a332814c7a51277df7eaa4e247182c189396

  • SSDEEP

    98304:u+HT2dFOlkJa7jNZC2ePu9ILkthheCYlOaX:3zMKBrC2kuA8hntM

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 23 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027.exe
    "C:\Users\Admin\AppData\Local\Temp\6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
    • C:\Users\Admin\AppData\Local\Temp\6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027.exe
      "C:\Users\Admin\AppData\Local\Temp\6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2300
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4820
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2944
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1608
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4084
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:396
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:944
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
              PID:1620
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              4⤵
                PID:3760
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:1540
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                4⤵
                  PID:2228
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    5⤵
                      PID:3816
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        6⤵
                        • Launches sc.exe
                        PID:1684
            • C:\Windows\windefender.exe
              C:\Windows\windefender.exe
              1⤵
                PID:4548

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2c3yep2j.lkd.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      3d086a433708053f9bf9523e1d87a4e8

                      SHA1

                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                      SHA256

                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                      SHA512

                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      55eeedfe95ca69df67a31daa601f8f5c

                      SHA1

                      531f08437cf20de15bbf0cb260d56e0e62623de6

                      SHA256

                      8dfa01b4fe2f1be656d396c0700bb67fb2bb1fd2591a26c0324a00adf18125e4

                      SHA512

                      8d71dcc70a92933107ad59a7d11c13e1072d55deddab37d8ad424a6d238e49acbd1254ebd0ca493d08e2b0f74abdbe131745d6b3499a1d25ff71b098cb21d47a

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      cfa47360cc8a3960bcdd19734f214d5a

                      SHA1

                      9818e5f77139ca641d33604a48df74587a426f3d

                      SHA256

                      af21ab989e817ce8404cdfbd92a5734a24377190803e6fad62901c92a63fe7a1

                      SHA512

                      f5d8594e5ce1f85236c9acd10e67eacf2795c3af22f142d954f00ddb8b7c08bc13ef2556f94a53a344d28cc9f69fb33a7c8714f4b9db6ec74e3cefc43248b761

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      3c72322e9cd0c736551661c33a74a9f3

                      SHA1

                      c8b92947b0b63bd9220226bb35cb952ca5410034

                      SHA256

                      7b7182a5a26e67d1fa0b46e487ad0ea1302d6cb1f1559785bd55709dca81fdab

                      SHA512

                      96cb58e305f4316dc935847f4d407e144b83f8d640b57e74709ffde7e39e7a676d673c77bc085a93d02239d002a719b5a72e379fb9a76659be1fb84d4b908134

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      69035066660c39e81b1fc295ea44a831

                      SHA1

                      3e8fb3653c223952996da188ecd7211cf7c278bb

                      SHA256

                      721c012f0e328909964154f3e24926232225c27f15a18b9463cb5ca2ac0b5496

                      SHA512

                      e8e676de0da7e8db05cbeff611cc43179c14ac271e79fb8bdef0565a1f2eb74e9c524b3435034f77fe1b5c7c531b575c613a3792a0c2205c2411ba0543fd9414

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      fa74800ad31ecafdda7829c3c8ecd6f8

                      SHA1

                      7001671fe85fe47bb13b6dfe7c55e641da7deaa6

                      SHA256

                      d1608d9f944add84e70872f79978e0d012857b0c2edadaf24d877b5d7f036ad5

                      SHA512

                      78b480d59e72822e6ad17c8ffba240c2957406da45138d7d6e1d7b187c3f2a25f09d13916b5e1b0b4ab35d6f0ad7339c571eb8362c3b1de9dcb168a0b1bb9ea6

                    • C:\Windows\rss\csrss.exe

                      Filesize

                      4.2MB

                      MD5

                      8fd2b4ce721563b89d313ec0d5283d62

                      SHA1

                      51d31a9e5aec6ff42c2bd0ffc041b9b170fef505

                      SHA256

                      6743985174a766c5e8eb2ff26f09308e0d7783710e74d20504e7c533a1f8e027

                      SHA512

                      6421db81816f265452625e3b00ab368b24e4d9c8a809354df2101b08b727b12c2e63544ddf4f577732bca23a32c2a332814c7a51277df7eaa4e247182c189396

                    • C:\Windows\windefender.exe

                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                    • memory/1528-125-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/1528-121-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/1528-106-0x0000000004D50000-0x0000000005153000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1528-60-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/1528-59-0x0000000005160000-0x0000000005A4B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/1528-58-0x0000000004D50000-0x0000000005153000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1528-240-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/1720-21-0x0000000005710000-0x0000000005A64000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1720-50-0x0000000007360000-0x0000000007368000-memory.dmp

                      Filesize

                      32KB

                    • memory/1720-27-0x0000000007620000-0x0000000007C9A000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/1720-30-0x0000000007180000-0x00000000071B2000-memory.dmp

                      Filesize

                      200KB

                    • memory/1720-31-0x0000000070B10000-0x0000000070B5C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1720-29-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1720-32-0x0000000070C90000-0x0000000070FE4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1720-42-0x0000000007160000-0x000000000717E000-memory.dmp

                      Filesize

                      120KB

                    • memory/1720-43-0x00000000071C0000-0x0000000007263000-memory.dmp

                      Filesize

                      652KB

                    • memory/1720-44-0x00000000072B0000-0x00000000072BA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1720-45-0x00000000073C0000-0x0000000007456000-memory.dmp

                      Filesize

                      600KB

                    • memory/1720-46-0x00000000072C0000-0x00000000072D1000-memory.dmp

                      Filesize

                      68KB

                    • memory/1720-47-0x0000000007300000-0x000000000730E000-memory.dmp

                      Filesize

                      56KB

                    • memory/1720-48-0x0000000007320000-0x0000000007334000-memory.dmp

                      Filesize

                      80KB

                    • memory/1720-49-0x0000000007370000-0x000000000738A000-memory.dmp

                      Filesize

                      104KB

                    • memory/1720-28-0x0000000006FC0000-0x0000000006FDA000-memory.dmp

                      Filesize

                      104KB

                    • memory/1720-53-0x0000000074C70000-0x0000000075420000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1720-26-0x0000000006F20000-0x0000000006F96000-memory.dmp

                      Filesize

                      472KB

                    • memory/1720-25-0x0000000004800000-0x0000000004810000-memory.dmp

                      Filesize

                      64KB

                    • memory/1720-24-0x00000000061A0000-0x00000000061E4000-memory.dmp

                      Filesize

                      272KB

                    • memory/1720-23-0x0000000005C50000-0x0000000005C9C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1720-22-0x0000000005C20000-0x0000000005C3E000-memory.dmp

                      Filesize

                      120KB

                    • memory/1720-11-0x00000000055A0000-0x0000000005606000-memory.dmp

                      Filesize

                      408KB

                    • memory/1720-10-0x0000000004DB0000-0x0000000004E16000-memory.dmp

                      Filesize

                      408KB

                    • memory/1720-9-0x0000000004C10000-0x0000000004C32000-memory.dmp

                      Filesize

                      136KB

                    • memory/1720-8-0x0000000004E40000-0x0000000005468000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/1720-4-0x0000000002650000-0x0000000002686000-memory.dmp

                      Filesize

                      216KB

                    • memory/1720-7-0x0000000004800000-0x0000000004810000-memory.dmp

                      Filesize

                      64KB

                    • memory/1720-6-0x0000000004800000-0x0000000004810000-memory.dmp

                      Filesize

                      64KB

                    • memory/1720-5-0x0000000074C70000-0x0000000075420000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2228-269-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2300-77-0x0000000070DB0000-0x0000000071104000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2300-88-0x0000000007460000-0x0000000007471000-memory.dmp

                      Filesize

                      68KB

                    • memory/2300-89-0x00000000074B0000-0x00000000074C4000-memory.dmp

                      Filesize

                      80KB

                    • memory/2300-92-0x0000000074D10000-0x00000000754C0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2300-87-0x0000000007140000-0x00000000071E3000-memory.dmp

                      Filesize

                      652KB

                    • memory/2300-61-0x0000000074D10000-0x00000000754C0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2300-62-0x0000000002600000-0x0000000002610000-memory.dmp

                      Filesize

                      64KB

                    • memory/2300-63-0x0000000002600000-0x0000000002610000-memory.dmp

                      Filesize

                      64KB

                    • memory/2300-76-0x0000000070C10000-0x0000000070C5C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2300-73-0x0000000005AC0000-0x0000000005E14000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2300-74-0x0000000005FC0000-0x000000000600C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2300-75-0x0000000002600000-0x0000000002610000-memory.dmp

                      Filesize

                      64KB

                    • memory/2944-110-0x0000000070C10000-0x0000000070C5C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2944-94-0x0000000074D10000-0x00000000754C0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2944-109-0x0000000002890000-0x00000000028A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2944-122-0x000000007F360000-0x000000007F370000-memory.dmp

                      Filesize

                      64KB

                    • memory/2944-124-0x0000000074D10000-0x00000000754C0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2944-107-0x0000000002890000-0x00000000028A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2944-111-0x0000000070D90000-0x00000000710E4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2944-95-0x0000000002890000-0x00000000028A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2944-105-0x0000000005E00000-0x0000000006154000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3440-1-0x0000000004ED0000-0x00000000052D4000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/3440-2-0x00000000052E0000-0x0000000005BCB000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/3440-56-0x00000000052E0000-0x0000000005BCB000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/3440-55-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/3440-54-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/3440-3-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/3908-131-0x0000000074D10000-0x00000000754C0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/3908-132-0x0000000006290000-0x00000000065E4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3908-138-0x0000000005390000-0x00000000053A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3908-134-0x0000000005390000-0x00000000053A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4548-279-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4548-288-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4548-272-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/5100-275-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-270-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-278-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-260-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-281-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-285-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-287-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-273-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-290-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-293-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-296-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB

                    • memory/5100-299-0x0000000000400000-0x000000000310E000-memory.dmp

                      Filesize

                      45.1MB