Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/04/2024, 19:34

General

  • Target

    9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019.exe

  • Size

    4.2MB

  • MD5

    851fec5951f63d857ddcb88249318157

  • SHA1

    ce73a9ca947a1ade1a6c61999641921a61804914

  • SHA256

    9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019

  • SHA512

    63b17608a33ce403b165fbc181915057d7d3c736a714467c40eafaf1dde50f5bca47429bee04591d4c50a7f99e1722242fbf444f1e72c3fa6d13592159b58bb8

  • SSDEEP

    98304:Lz8muvG4/7oo98xMphVIqHAQJ7eNfIWzS5gC960Xfu6ti9vBy29y:LzvuvT/7/zVIWAQdeNfIWzX0W6tA420

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 21 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019.exe
    "C:\Users\Admin\AppData\Local\Temp\9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5048
    • C:\Users\Admin\AppData\Local\Temp\9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019.exe
      "C:\Users\Admin\AppData\Local\Temp\9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3164
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2356
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4820
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3256
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:772
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3428
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4916
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4264
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:828
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4632
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5080
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:2148
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1440

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z32r1vwq.5qf.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            ac4917a885cf6050b1a483e4bc4d2ea5

            SHA1

            b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

            SHA256

            e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

            SHA512

            092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            928fe47acb53c4f81cbae273d1b80bc8

            SHA1

            dcc0ea8083ccd388b4a9369de71c7bcc33453abd

            SHA256

            72ffe2baf6a5e642f1d6253a35ff32cbebed518c0db916d1988716347fa343b9

            SHA512

            796bc870a5aa987cd15a21a1a0629312855ef2a07619da3e8cd4b5cffaa7ebc2ceee01c4f01080345e4a96be724ea17b5bbb1f7c1c47a5e56799c21a99547432

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            09c80b60c5019479088f5f90546e246e

            SHA1

            d9f20abe4fb9a349b01c90abd9cb0143be580900

            SHA256

            042722b882d18750235a39ff8fa0f7e4d65e49061a735c0a0d4929ce947ab45f

            SHA512

            4d9d26dd1a592e97134c45ba4533463f6a19111a2f61b8110b05c9c39a076d197ab5cb6fd1aac5971e9265e5f5f3c7ae5ebcb407d0f6c17deffd323e225960c0

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            4a514148ca1b91ab961ad22afb39ef6b

            SHA1

            b850c080812f2c08930efa49c931d787dd81576d

            SHA256

            1c0a8f516f5342d4f3bc9eaabfcdcf2500198a4012b581008c8e2b259c539df0

            SHA512

            b284b036fd1083d7a4d77e3ec6aed7811272e3cad6dbb483390064530795f248c665439baccdb34acae948215ac15911d4b4b67a5c2cf85c4a511f01ebdfc157

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            0d1c68357e5508525b88459c7ac8fff9

            SHA1

            842c9fb09ffef5d73b5ea28ee2598ffd0444e532

            SHA256

            b46f3579642b83b0c7da2acb40e27041fb1ed51e26c2ffccc49639ce00cf9797

            SHA512

            5fcdf745e03187851730ff0ccfc6dcdcdc6ccbb293bb35b006321db6937eb7b1fe631d038ece7f624184834f24ad18f57f471adc1a5fdb01bc16ea4de300c16c

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            41bfb8e9dbd465ef64f5a5a0927f9597

            SHA1

            53942cb784cd8aae163f92ee4329bc87d61ffe55

            SHA256

            14d9512a62972056672daaf21a07fe6af5b857a4f19656272d78678cd67db46b

            SHA512

            849c5c15b71e900a58c2dd550a1ee5ade6bee902bfd26d54ad5291efbe3af25bba2750c9f18ce2ddf755eadf94f5279abcd0281f98205b9c1cd36bd1cbda90dd

          • C:\Windows\rss\csrss.exe

            Filesize

            4.2MB

            MD5

            851fec5951f63d857ddcb88249318157

            SHA1

            ce73a9ca947a1ade1a6c61999641921a61804914

            SHA256

            9ba7977c2790d70fc5084c157fc75bc325cc2bf853c9400a2c221b90ae6d7019

            SHA512

            63b17608a33ce403b165fbc181915057d7d3c736a714467c40eafaf1dde50f5bca47429bee04591d4c50a7f99e1722242fbf444f1e72c3fa6d13592159b58bb8

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/1440-268-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/1440-262-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/3164-83-0x00000000067C0000-0x00000000067D1000-memory.dmp

            Filesize

            68KB

          • memory/3164-88-0x0000000074710000-0x0000000074EC1000-memory.dmp

            Filesize

            7.7MB

          • memory/3164-59-0x00000000050E0000-0x00000000050F0000-memory.dmp

            Filesize

            64KB

          • memory/3164-60-0x00000000050E0000-0x00000000050F0000-memory.dmp

            Filesize

            64KB

          • memory/3164-69-0x0000000005FD0000-0x0000000006327000-memory.dmp

            Filesize

            3.3MB

          • memory/3164-70-0x00000000069E0000-0x0000000006A2C000-memory.dmp

            Filesize

            304KB

          • memory/3164-71-0x00000000050E0000-0x00000000050F0000-memory.dmp

            Filesize

            64KB

          • memory/3164-72-0x00000000709F0000-0x0000000070A3C000-memory.dmp

            Filesize

            304KB

          • memory/3164-73-0x0000000070C00000-0x0000000070F57000-memory.dmp

            Filesize

            3.3MB

          • memory/3164-82-0x0000000007710000-0x00000000077B4000-memory.dmp

            Filesize

            656KB

          • memory/3164-58-0x0000000074710000-0x0000000074EC1000-memory.dmp

            Filesize

            7.7MB

          • memory/3164-85-0x0000000007AB0000-0x0000000007AC5000-memory.dmp

            Filesize

            84KB

          • memory/3540-270-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-267-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-261-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-242-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-276-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-273-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-251-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-264-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/3540-185-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4004-47-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4004-52-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4004-53-0x0000000005360000-0x0000000005C4B000-memory.dmp

            Filesize

            8.9MB

          • memory/4004-2-0x0000000005360000-0x0000000005C4B000-memory.dmp

            Filesize

            8.9MB

          • memory/4004-1-0x0000000004F50000-0x0000000005357000-memory.dmp

            Filesize

            4.0MB

          • memory/4004-3-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4820-123-0x0000000002980000-0x0000000002990000-memory.dmp

            Filesize

            64KB

          • memory/4820-121-0x0000000074710000-0x0000000074EC1000-memory.dmp

            Filesize

            7.7MB

          • memory/4820-134-0x00000000709F0000-0x0000000070A3C000-memory.dmp

            Filesize

            304KB

          • memory/4820-133-0x0000000002980000-0x0000000002990000-memory.dmp

            Filesize

            64KB

          • memory/4820-122-0x0000000002980000-0x0000000002990000-memory.dmp

            Filesize

            64KB

          • memory/4856-118-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-57-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-150-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-56-0x0000000005240000-0x0000000005B2B000-memory.dmp

            Filesize

            8.9MB

          • memory/4856-55-0x0000000004E40000-0x000000000523F000-memory.dmp

            Filesize

            4.0MB

          • memory/4856-84-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-90-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-102-0x0000000000400000-0x000000000310E000-memory.dmp

            Filesize

            45.1MB

          • memory/4856-89-0x0000000004E40000-0x000000000523F000-memory.dmp

            Filesize

            4.0MB

          • memory/4984-107-0x000000007FCA0000-0x000000007FCB0000-memory.dmp

            Filesize

            64KB

          • memory/4984-109-0x0000000070C40000-0x0000000070F97000-memory.dmp

            Filesize

            3.3MB

          • memory/4984-92-0x00000000054E0000-0x0000000005837000-memory.dmp

            Filesize

            3.3MB

          • memory/4984-108-0x00000000709F0000-0x0000000070A3C000-memory.dmp

            Filesize

            304KB

          • memory/4984-120-0x0000000074710000-0x0000000074EC1000-memory.dmp

            Filesize

            7.7MB

          • memory/4984-103-0x0000000074710000-0x0000000074EC1000-memory.dmp

            Filesize

            7.7MB

          • memory/4984-104-0x0000000004620000-0x0000000004630000-memory.dmp

            Filesize

            64KB

          • memory/4984-105-0x0000000004620000-0x0000000004630000-memory.dmp

            Filesize

            64KB

          • memory/4984-106-0x0000000004620000-0x0000000004630000-memory.dmp

            Filesize

            64KB

          • memory/5048-40-0x0000000007010000-0x000000000702A000-memory.dmp

            Filesize

            104KB

          • memory/5048-26-0x000000007FA30000-0x000000007FA40000-memory.dmp

            Filesize

            64KB

          • memory/5048-48-0x00000000072F0000-0x00000000072F8000-memory.dmp

            Filesize

            32KB

          • memory/5048-38-0x0000000006EE0000-0x0000000006F84000-memory.dmp

            Filesize

            656KB

          • memory/5048-46-0x00000000071D0000-0x00000000071EA000-memory.dmp

            Filesize

            104KB

          • memory/5048-41-0x0000000007050000-0x000000000705A000-memory.dmp

            Filesize

            40KB

          • memory/5048-42-0x0000000007110000-0x00000000071A6000-memory.dmp

            Filesize

            600KB

          • memory/5048-51-0x0000000074670000-0x0000000074E21000-memory.dmp

            Filesize

            7.7MB

          • memory/5048-37-0x0000000006E80000-0x0000000006E9E000-memory.dmp

            Filesize

            120KB

          • memory/5048-43-0x0000000007080000-0x0000000007091000-memory.dmp

            Filesize

            68KB

          • memory/5048-44-0x00000000070C0000-0x00000000070CE000-memory.dmp

            Filesize

            56KB

          • memory/5048-28-0x0000000070AB0000-0x0000000070E07000-memory.dmp

            Filesize

            3.3MB

          • memory/5048-45-0x00000000070D0000-0x00000000070E5000-memory.dmp

            Filesize

            84KB

          • memory/5048-27-0x00000000708E0000-0x000000007092C000-memory.dmp

            Filesize

            304KB

          • memory/5048-25-0x0000000006EA0000-0x0000000006ED4000-memory.dmp

            Filesize

            208KB

          • memory/5048-39-0x0000000007650000-0x0000000007CCA000-memory.dmp

            Filesize

            6.5MB

          • memory/5048-24-0x0000000000EF0000-0x0000000000F00000-memory.dmp

            Filesize

            64KB

          • memory/5048-23-0x0000000005FE0000-0x0000000006026000-memory.dmp

            Filesize

            280KB

          • memory/5048-22-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

            Filesize

            304KB

          • memory/5048-21-0x00000000059F0000-0x0000000005A0E000-memory.dmp

            Filesize

            120KB

          • memory/5048-20-0x0000000005510000-0x0000000005867000-memory.dmp

            Filesize

            3.3MB

          • memory/5048-5-0x0000000074670000-0x0000000074E21000-memory.dmp

            Filesize

            7.7MB

          • memory/5048-11-0x0000000005420000-0x0000000005486000-memory.dmp

            Filesize

            408KB

          • memory/5048-10-0x0000000004C40000-0x0000000004CA6000-memory.dmp

            Filesize

            408KB

          • memory/5048-9-0x0000000004B90000-0x0000000004BB2000-memory.dmp

            Filesize

            136KB

          • memory/5048-8-0x0000000004DF0000-0x000000000541A000-memory.dmp

            Filesize

            6.2MB

          • memory/5048-7-0x0000000000EF0000-0x0000000000F00000-memory.dmp

            Filesize

            64KB

          • memory/5048-6-0x0000000000EF0000-0x0000000000F00000-memory.dmp

            Filesize

            64KB

          • memory/5048-4-0x0000000000DD0000-0x0000000000E06000-memory.dmp

            Filesize

            216KB

          • memory/5080-259-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB