Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 20:23

General

  • Target

    8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f.exe

  • Size

    4.2MB

  • MD5

    08ac55e6e61e9315ce956b99e5a0fb51

  • SHA1

    803c344a9e8f79b66e209dffa10bdd61a76f32f6

  • SHA256

    8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f

  • SHA512

    1827878cce05815659156a4672072c9faa2fb758e412531d93104c67a69b233c4b886de8aeca78ffc0118ef08652064ae2c4df050b591b372e9dc64226594948

  • SSDEEP

    98304:WRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9UT:bUuqUAddtM55murAiy9m

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f.exe
    "C:\Users\Admin\AppData\Local\Temp\8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5032
    • C:\Users\Admin\AppData\Local\Temp\8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f.exe
      "C:\Users\Admin\AppData\Local\Temp\8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4512
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4744
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3988
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1220
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1740
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3736
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5060
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4968
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1836
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4268
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3840
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2584
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:2212
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 936
        2⤵
        • Program crash
        PID:1088
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4112,i,4770062162764366287,7825742579436984831,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
      1⤵
        PID:1836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4748 -ip 4748
        1⤵
          PID:2704
        • C:\Windows\windefender.exe
          C:\Windows\windefender.exe
          1⤵
          • Executes dropped EXE
          PID:4648

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpjdiif4.0xz.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                3d086a433708053f9bf9523e1d87a4e8

                SHA1

                b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                SHA256

                6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                SHA512

                931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                33e48d593dbb6d5627e2e37dc807093d

                SHA1

                c3d9f388417ecf73dccdb57c60bceb8a8dc8381d

                SHA256

                3bc5c9af54134756ac39d7a0714c70939b51aa692162fa0f59314bf4e0a0ad80

                SHA512

                97027cf39ab1d8071f19fa5f468922c5531e72c0ca0a188173cd25bc6c74071f336963739b3bdc4b53df0ba68d1e25c40d171b0ad90298a5f5dfcf53abcef134

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                95b16efb74a4135c1ad77b569a173bd9

                SHA1

                88b9071e2d0bccc3ac5ed1982831fec6ed766b68

                SHA256

                47613a90b1cc2e261b85d3e52876f07e520f7cfd6cb64590ee5e09e01e68831c

                SHA512

                52cffe3def746569e3bb33eba4b5a6d939a2fc926c98152c35bc09a504d700842a0fe5255999e26ab4d6dea0f85b5729e95dfa1d1ce9764e25c111a977a62902

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                6cba4c59b0522dadd1252d2d82b28a0a

                SHA1

                49647cb4a7e57fe33fd714f92c1b6c2ab2f39cf1

                SHA256

                11a3dfa91d8560d0201726d71c75f00c4fc6c1a945c1311038a6ed0caf45e9a5

                SHA512

                f18770c3491c24c3e09c99d05fa84d9337fa320932d1b0005b36fcc10be067b8392003446025d121d195af3349b804ace24512ddec9cc3032446c855cb6be609

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                5f78e7bf506a6b607c9dc442c6db1d98

                SHA1

                932eb56aa51cc3452da779e033a8462eb1cf2fca

                SHA256

                9b9eff71ba5d19925daeba1f5db41fbd16373ae3cce2764de454e68c910a6055

                SHA512

                e4fcca1a2940cb7f5c310d2d130db5e5cde8442e867c2e5e6a9333b8eee272e0df9e7043a123ad706a1664a2500d69a3131c024e6b0d21bf05cfc5f79e75c70a

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                06360b9864af561a2be213192236674f

                SHA1

                818ff2bbf77106a01e863495cc6ddd8ac908b746

                SHA256

                dcd204cd483369b88af99dde645530c4d2c33be8932b3474c0372cb73aede20e

                SHA512

                4440d5d5b0555ef0d542ff612cbffd3f9e953be673f41cfbc4c11aa4aca32bdf18595162dfb185499e76a2b9741247bb55e2ee75ca954901eb2ac67092d273c5

              • C:\Windows\rss\csrss.exe

                Filesize

                4.2MB

                MD5

                08ac55e6e61e9315ce956b99e5a0fb51

                SHA1

                803c344a9e8f79b66e209dffa10bdd61a76f32f6

                SHA256

                8fbbe0abb258abe568b9320f2ae5db64f922a63ff1bbed20dd540d44cee3eb9f

                SHA512

                1827878cce05815659156a4672072c9faa2fb758e412531d93104c67a69b233c4b886de8aeca78ffc0118ef08652064ae2c4df050b591b372e9dc64226594948

              • C:\Windows\windefender.exe

                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              • memory/436-142-0x00000000704A0000-0x00000000704EC000-memory.dmp

                Filesize

                304KB

              • memory/436-129-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

                Filesize

                64KB

              • memory/436-128-0x00000000745A0000-0x0000000074D50000-memory.dmp

                Filesize

                7.7MB

              • memory/436-130-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

                Filesize

                64KB

              • memory/436-141-0x000000007FCF0000-0x000000007FD00000-memory.dmp

                Filesize

                64KB

              • memory/1040-159-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/1040-77-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/1040-112-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/1040-61-0x00000000033A0000-0x00000000037A3000-memory.dmp

                Filesize

                4.0MB

              • memory/1040-153-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/1040-97-0x00000000033A0000-0x00000000037A3000-memory.dmp

                Filesize

                4.0MB

              • memory/1040-113-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/1040-62-0x0000000005150000-0x0000000005A3B000-memory.dmp

                Filesize

                8.9MB

              • memory/1040-63-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3304-258-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3304-228-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3304-164-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3304-266-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3304-274-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/3840-273-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/3988-114-0x00000000704A0000-0x00000000704EC000-memory.dmp

                Filesize

                304KB

              • memory/3988-99-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

                Filesize

                64KB

              • memory/3988-98-0x00000000745A0000-0x0000000074D50000-memory.dmp

                Filesize

                7.7MB

              • memory/3988-100-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

                Filesize

                64KB

              • memory/3988-110-0x0000000005D50000-0x00000000060A4000-memory.dmp

                Filesize

                3.3MB

              • memory/3988-115-0x0000000070620000-0x0000000070974000-memory.dmp

                Filesize

                3.3MB

              • memory/3988-125-0x000000007F700000-0x000000007F710000-memory.dmp

                Filesize

                64KB

              • memory/3988-127-0x00000000745A0000-0x0000000074D50000-memory.dmp

                Filesize

                7.7MB

              • memory/4512-75-0x00000000062E0000-0x0000000006634000-memory.dmp

                Filesize

                3.3MB

              • memory/4512-78-0x0000000005420000-0x0000000005430000-memory.dmp

                Filesize

                64KB

              • memory/4512-95-0x00000000745A0000-0x0000000074D50000-memory.dmp

                Filesize

                7.7MB

              • memory/4512-92-0x0000000007E40000-0x0000000007E54000-memory.dmp

                Filesize

                80KB

              • memory/4512-64-0x00000000745A0000-0x0000000074D50000-memory.dmp

                Filesize

                7.7MB

              • memory/4512-65-0x0000000005420000-0x0000000005430000-memory.dmp

                Filesize

                64KB

              • memory/4512-91-0x0000000007DF0000-0x0000000007E01000-memory.dmp

                Filesize

                68KB

              • memory/4512-76-0x0000000006E50000-0x0000000006E9C000-memory.dmp

                Filesize

                304KB

              • memory/4512-90-0x0000000007B00000-0x0000000007BA3000-memory.dmp

                Filesize

                652KB

              • memory/4512-80-0x0000000070C00000-0x0000000070F54000-memory.dmp

                Filesize

                3.3MB

              • memory/4512-79-0x00000000704A0000-0x00000000704EC000-memory.dmp

                Filesize

                304KB

              • memory/4648-275-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4748-59-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/4748-3-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/4748-1-0x00000000032E0000-0x00000000036DF000-memory.dmp

                Filesize

                4.0MB

              • memory/4748-2-0x0000000005080000-0x000000000596B000-memory.dmp

                Filesize

                8.9MB

              • memory/4748-53-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/4748-4-0x0000000000400000-0x0000000003009000-memory.dmp

                Filesize

                44.0MB

              • memory/4748-31-0x00000000032E0000-0x00000000036DF000-memory.dmp

                Filesize

                4.0MB

              • memory/4748-50-0x0000000005080000-0x000000000596B000-memory.dmp

                Filesize

                8.9MB

              • memory/5032-35-0x0000000070520000-0x0000000070874000-memory.dmp

                Filesize

                3.3MB

              • memory/5032-24-0x0000000006030000-0x000000000607C000-memory.dmp

                Filesize

                304KB

              • memory/5032-47-0x00000000076A0000-0x00000000076AA000-memory.dmp

                Filesize

                40KB

              • memory/5032-46-0x00000000075C0000-0x0000000007663000-memory.dmp

                Filesize

                652KB

              • memory/5032-45-0x0000000007560000-0x000000000757E000-memory.dmp

                Filesize

                120KB

              • memory/5032-49-0x00000000076C0000-0x00000000076D1000-memory.dmp

                Filesize

                68KB

              • memory/5032-34-0x00000000703A0000-0x00000000703EC000-memory.dmp

                Filesize

                304KB

              • memory/5032-33-0x0000000007580000-0x00000000075B2000-memory.dmp

                Filesize

                200KB

              • memory/5032-32-0x000000007F660000-0x000000007F670000-memory.dmp

                Filesize

                64KB

              • memory/5032-51-0x0000000007720000-0x000000000772E000-memory.dmp

                Filesize

                56KB

              • memory/5032-30-0x00000000073B0000-0x00000000073CA000-memory.dmp

                Filesize

                104KB

              • memory/5032-29-0x0000000007A30000-0x00000000080AA000-memory.dmp

                Filesize

                6.5MB

              • memory/5032-28-0x0000000007330000-0x00000000073A6000-memory.dmp

                Filesize

                472KB

              • memory/5032-27-0x00000000029E0000-0x00000000029F0000-memory.dmp

                Filesize

                64KB

              • memory/5032-25-0x00000000065A0000-0x00000000065E4000-memory.dmp

                Filesize

                272KB

              • memory/5032-48-0x0000000007760000-0x00000000077F6000-memory.dmp

                Filesize

                600KB

              • memory/5032-23-0x0000000005FF0000-0x000000000600E000-memory.dmp

                Filesize

                120KB

              • memory/5032-22-0x0000000005B30000-0x0000000005E84000-memory.dmp

                Filesize

                3.3MB

              • memory/5032-21-0x0000000005AC0000-0x0000000005B26000-memory.dmp

                Filesize

                408KB

              • memory/5032-20-0x00000000059E0000-0x0000000005A46000-memory.dmp

                Filesize

                408KB

              • memory/5032-15-0x00000000057E0000-0x0000000005802000-memory.dmp

                Filesize

                136KB

              • memory/5032-8-0x00000000029E0000-0x00000000029F0000-memory.dmp

                Filesize

                64KB

              • memory/5032-9-0x00000000029E0000-0x00000000029F0000-memory.dmp

                Filesize

                64KB

              • memory/5032-7-0x0000000074500000-0x0000000074CB0000-memory.dmp

                Filesize

                7.7MB

              • memory/5032-6-0x00000000050B0000-0x00000000056D8000-memory.dmp

                Filesize

                6.2MB

              • memory/5032-52-0x0000000007730000-0x0000000007744000-memory.dmp

                Filesize

                80KB

              • memory/5032-5-0x0000000002960000-0x0000000002996000-memory.dmp

                Filesize

                216KB

              • memory/5032-54-0x0000000007820000-0x000000000783A000-memory.dmp

                Filesize

                104KB

              • memory/5032-55-0x0000000007810000-0x0000000007818000-memory.dmp

                Filesize

                32KB

              • memory/5032-58-0x0000000074500000-0x0000000074CB0000-memory.dmp

                Filesize

                7.7MB