Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 19:10

General

  • Target

    2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c.exe

  • Size

    4.2MB

  • MD5

    9709aac66eb52e7354b6ac1ace25ddf1

  • SHA1

    422cefdfc444f8e607986abef52c6fa4b4899b8d

  • SHA256

    2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c

  • SHA512

    c4de7bf94e2002a58b56efd82df8f898095376e13ead79ea58776cd70c3988b8a59a3405c9946dec5db448e6ae720f99d4be2f0319a6e4e8c12621331fb7c395

  • SSDEEP

    98304:xqrB5wn4OMCZOc7+DuxcvwRwKkZb9A25YIHnzSUGXdTRu1L6r:eBo4d4+DucuGBGNT0La

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 20 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c.exe
    "C:\Users\Admin\AppData\Local\Temp\2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5032
    • C:\Users\Admin\AppData\Local\Temp\2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c.exe
      "C:\Users\Admin\AppData\Local\Temp\2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2024
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2452
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2824
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3712
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3804
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3676
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3148
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1904
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4632
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:1864
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4476
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4364
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:32
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1840

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cymqpfw3.goa.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            50bff6c9f04cf86ccd32ba18e65d436e

            SHA1

            27793f7688b2ec3aabfe1e6bdfc96366142576e8

            SHA256

            d9141d97820feccde9479bfaa7d31823352cc04abef162e279117393de3d3d02

            SHA512

            042172a7725b3a94e032e1ea1359a2b80fedd66992f27ab7c12ff3b36caca061321740b8b9078e70b437d784c19ad22c4aac616dc30fcf5a121533e77c68467e

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            ec6f2c7f6bbb0c2c25e72311ce078afd

            SHA1

            856ccdc7b386f18b03fa65bd4bfaad4ef46e22bb

            SHA256

            91900bb3bd0659584bcd9d2bc79e932e52c8ca778921f04f9fc549e936468f77

            SHA512

            748a3ce193cfe9e31d2c48fdf047b0aaee0bdf1f7baee5f018ad790a0c453304ba95ed23f91d43963996bba6b17857b5c480c9339ad7485ee5e548be42a59087

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            bf7ba2012400871cab776c966f89bab8

            SHA1

            0a4cf44a0f205c8cb9bef9ae32a39c4328c031da

            SHA256

            79f44d55a3137d70b6f9d7f6bb34cc0e2eb258b9b1c9a9f57c1a8011e793a407

            SHA512

            4add29e2486845995cb59a26b36aece6d9d42066c783d07be8b3cfbb9cc7bee1fbc086c619c3a65fa47a05c12fbb483fac06a459d95059f802e1250849eb7e22

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            abdf0a37438686ec6d79b577f8111b58

            SHA1

            b95a1a2366e49f58335531dbd26e4fce026e37a0

            SHA256

            69c28634e4cc9dd505e9ce017d11951d380357a4390eb4017b79c1534c2481ec

            SHA512

            a2c21e5667cff957fde8581e234e5a33d46601bf35a1793f2d773631141b4474e8156824ec2c821a15d6384c266c531d5da0016c91d36614205bdc12563f622e

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            a09519dc158bebdf65a6ea4c9c6676f6

            SHA1

            c5c5865b6c279e1358e60282293efa439901965f

            SHA256

            a8812315b42e7e66361e5304528da12a1689339551784022e26389b560c29364

            SHA512

            789c9a4a23ed4bb84605c08ed94d1f8b778d9ce18fc63019e834c7309120e88d0faf356d3bacc4b9c547df2503a4f98c170f5ca32c2f6ddc70f168da52bd52c4

          • C:\Windows\rss\csrss.exe

            Filesize

            4.2MB

            MD5

            9709aac66eb52e7354b6ac1ace25ddf1

            SHA1

            422cefdfc444f8e607986abef52c6fa4b4899b8d

            SHA256

            2eeeb7f277838304a2a02b04ccc861d5bb0c7b2977d7aece244aaaca9aca530c

            SHA512

            c4de7bf94e2002a58b56efd82df8f898095376e13ead79ea58776cd70c3988b8a59a3405c9946dec5db448e6ae720f99d4be2f0319a6e4e8c12621331fb7c395

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/1392-57-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1392-184-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1392-54-0x0000000003BA0000-0x0000000003FA6000-memory.dmp

            Filesize

            4.0MB

          • memory/1392-117-0x0000000003BA0000-0x0000000003FA6000-memory.dmp

            Filesize

            4.0MB

          • memory/1392-56-0x0000000003FB0000-0x000000000489B000-memory.dmp

            Filesize

            8.9MB

          • memory/1392-134-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-276-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-296-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-280-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-284-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-288-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-305-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-292-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-254-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-265-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-301-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-308-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-272-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1572-269-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/1840-267-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/1840-275-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/2024-72-0x0000000070330000-0x000000007037C000-memory.dmp

            Filesize

            304KB

          • memory/2024-84-0x0000000007770000-0x0000000007813000-memory.dmp

            Filesize

            652KB

          • memory/2024-89-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/2024-86-0x0000000007AB0000-0x0000000007AC4000-memory.dmp

            Filesize

            80KB

          • memory/2024-85-0x0000000007A60000-0x0000000007A71000-memory.dmp

            Filesize

            68KB

          • memory/2024-83-0x0000000005050000-0x0000000005060000-memory.dmp

            Filesize

            64KB

          • memory/2024-73-0x00000000704B0000-0x0000000070804000-memory.dmp

            Filesize

            3.3MB

          • memory/2024-69-0x00000000060B0000-0x0000000006404000-memory.dmp

            Filesize

            3.3MB

          • memory/2024-68-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/2024-70-0x0000000005050000-0x0000000005060000-memory.dmp

            Filesize

            64KB

          • memory/2024-71-0x000000007EE80000-0x000000007EE90000-memory.dmp

            Filesize

            64KB

          • memory/2744-118-0x000000007FA00000-0x000000007FA10000-memory.dmp

            Filesize

            64KB

          • memory/2744-93-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

            Filesize

            64KB

          • memory/2744-106-0x0000000070330000-0x000000007037C000-memory.dmp

            Filesize

            304KB

          • memory/2744-91-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/2744-119-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

            Filesize

            64KB

          • memory/2744-103-0x0000000005CE0000-0x0000000006034000-memory.dmp

            Filesize

            3.3MB

          • memory/2744-107-0x0000000070AE0000-0x0000000070E34000-memory.dmp

            Filesize

            3.3MB

          • memory/2744-121-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/2744-92-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

            Filesize

            64KB

          • memory/2824-136-0x0000000070330000-0x000000007037C000-memory.dmp

            Filesize

            304KB

          • memory/2824-123-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

            Filesize

            64KB

          • memory/2824-137-0x0000000070AE0000-0x0000000070E34000-memory.dmp

            Filesize

            3.3MB

          • memory/2824-135-0x000000007F3E0000-0x000000007F3F0000-memory.dmp

            Filesize

            64KB

          • memory/2824-122-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/3704-55-0x0000000003BE0000-0x0000000003FE2000-memory.dmp

            Filesize

            4.0MB

          • memory/3704-2-0x0000000003FF0000-0x00000000048DB000-memory.dmp

            Filesize

            8.9MB

          • memory/3704-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/3704-67-0x0000000000400000-0x0000000001DFD000-memory.dmp

            Filesize

            26.0MB

          • memory/3704-1-0x0000000003BE0000-0x0000000003FE2000-memory.dmp

            Filesize

            4.0MB

          • memory/4476-262-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/5032-30-0x0000000070330000-0x000000007037C000-memory.dmp

            Filesize

            304KB

          • memory/5032-24-0x00000000061B0000-0x00000000061F4000-memory.dmp

            Filesize

            272KB

          • memory/5032-42-0x0000000007390000-0x0000000007433000-memory.dmp

            Filesize

            652KB

          • memory/5032-44-0x0000000007590000-0x0000000007626000-memory.dmp

            Filesize

            600KB

          • memory/5032-45-0x0000000007490000-0x00000000074A1000-memory.dmp

            Filesize

            68KB

          • memory/5032-46-0x00000000074D0000-0x00000000074DE000-memory.dmp

            Filesize

            56KB

          • memory/5032-41-0x0000000007370000-0x000000000738E000-memory.dmp

            Filesize

            120KB

          • memory/5032-31-0x0000000070700000-0x0000000070A54000-memory.dmp

            Filesize

            3.3MB

          • memory/5032-47-0x00000000074F0000-0x0000000007504000-memory.dmp

            Filesize

            80KB

          • memory/5032-29-0x0000000007330000-0x0000000007362000-memory.dmp

            Filesize

            200KB

          • memory/5032-28-0x000000007F310000-0x000000007F320000-memory.dmp

            Filesize

            64KB

          • memory/5032-27-0x0000000007170000-0x000000000718A000-memory.dmp

            Filesize

            104KB

          • memory/5032-26-0x00000000077D0000-0x0000000007E4A000-memory.dmp

            Filesize

            6.5MB

          • memory/5032-25-0x00000000070D0000-0x0000000007146000-memory.dmp

            Filesize

            472KB

          • memory/5032-48-0x0000000007530000-0x000000000754A000-memory.dmp

            Filesize

            104KB

          • memory/5032-43-0x0000000007480000-0x000000000748A000-memory.dmp

            Filesize

            40KB

          • memory/5032-23-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

            Filesize

            304KB

          • memory/5032-22-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

            Filesize

            120KB

          • memory/5032-21-0x00000000057B0000-0x0000000005B04000-memory.dmp

            Filesize

            3.3MB

          • memory/5032-11-0x0000000005640000-0x00000000056A6000-memory.dmp

            Filesize

            408KB

          • memory/5032-10-0x0000000004E90000-0x0000000004EF6000-memory.dmp

            Filesize

            408KB

          • memory/5032-9-0x0000000004DF0000-0x0000000004E12000-memory.dmp

            Filesize

            136KB

          • memory/5032-8-0x0000000004F50000-0x0000000005578000-memory.dmp

            Filesize

            6.2MB

          • memory/5032-7-0x0000000004910000-0x0000000004920000-memory.dmp

            Filesize

            64KB

          • memory/5032-6-0x0000000004910000-0x0000000004920000-memory.dmp

            Filesize

            64KB

          • memory/5032-4-0x0000000004800000-0x0000000004836000-memory.dmp

            Filesize

            216KB

          • memory/5032-5-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB

          • memory/5032-49-0x0000000007520000-0x0000000007528000-memory.dmp

            Filesize

            32KB

          • memory/5032-52-0x0000000074490000-0x0000000074C40000-memory.dmp

            Filesize

            7.7MB