Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 19:17

General

  • Target

    3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503.exe

  • Size

    4.2MB

  • MD5

    7e248f25f0af33ccd8993bd7f5c4a121

  • SHA1

    c4cdb88b61822c245445e680d2369a9b5417cab8

  • SHA256

    3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503

  • SHA512

    3d85d9cf79dce74e75a712fe2ae781a7859c380485d5c60f5a8de8f9e26639e5a8e66f6462f4effb7c2d6441668a6e7c03122f4275db3e931a8949891e55e7dc

  • SSDEEP

    98304:TtwUIgr6Tu/hivXD0fl0IvZVjhgp1+mYFjvUcmYnimsjZaHe9:Rw6rquKXDtU1Y2GYniVjUHI

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503.exe
    "C:\Users\Admin\AppData\Local\Temp\3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2832
    • C:\Users\Admin\AppData\Local\Temp\3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503.exe
      "C:\Users\Admin\AppData\Local\Temp\3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4644
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3812
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4696
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1496
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1672
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3432
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3324
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1304
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4580
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1812
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 872
          3⤵
          • Program crash
          PID:1452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 720
        2⤵
        • Program crash
        PID:4388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2660 -ip 2660
      1⤵
        PID:1948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4852 -ip 4852
        1⤵
          PID:4400
        • C:\Windows\windefender.exe
          C:\Windows\windefender.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:3632

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4owwwtu2.b0h.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                3d086a433708053f9bf9523e1d87a4e8

                SHA1

                b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                SHA256

                6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                SHA512

                931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                954d8baed4644eea1bfe47f56bf4a293

                SHA1

                371d3729669588d5663621c5f7117c2837cff7c4

                SHA256

                04dc9fe01241058306fade3b3b6f07d7a2a78e9b85213ff7ca7efbfc34ffa598

                SHA512

                58bf0ce7c1459c2253c6efd5b47e31bc46c4f4a4b9eab61e8a66a5e360ec791421d3dc5b551eec8ed61f9ee2b9a3aa3ee705fd2bff10e5609b9290cc482795fa

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                43bb8601b32f50e2bdea7f9aab5c2ef0

                SHA1

                38f61bca86e355f660c4e4fa210170e9b56eb83e

                SHA256

                733d177977b2c781d800aab016a70d4044f2a39331af32e08628e9421bc2975b

                SHA512

                cfb558d33ade93415a40f3f04e8009cd1dc32bd0c6015c52c7af4bbd43097bf1b03355ce6f16bddd779070aac001c0298d994b05fa74dffb84d7bfb7ccc0a4e6

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                6db27b4d61c2db00db63a9b0b9379be5

                SHA1

                c667266ec226eceb4daaff3db97583283f6c98a9

                SHA256

                798ed51387f83f4a306146d0e2d25a1f846ae38e83fb688d6ec7cf5a51085bbb

                SHA512

                5e42385cb32ab0944f11eb4997d205c2f20670f8a59e07b941b33bdba292cf10c91bb37cb41dd73fa198c22c73af82678a47f88ba13b6ea75be6a12892d700ab

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                afb0638dcbd511f3d4a21df6b639b7d7

                SHA1

                c6533f240be39022cd66892c56d17e743d3e8ff8

                SHA256

                d2956d3794341f9ec30d4982f49a8a708d74f6283e03b40580c6cfbda3b80781

                SHA512

                61ba83d2cd6e29f22d7b29fd386a75e37b978256db4933124291234e04be2f74e9497a12717eb84e358c49486875f50ae438321316f6d83ae167adf0c9502984

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                1f8f9de51a49155c7237e7900fc42d26

                SHA1

                32be4420f5be03242289d4584814ca1a99c594f5

                SHA256

                db1faba89526b88d637c5154ad10538879f91b2747d0255791df7a6fbb228d7c

                SHA512

                d039a37c7633a54f6b55cac5780c195855d94128affbb1e018cf4ee6ccaa5c67ebd8b08fb7b05a3dff9ad0946ac70c5de3fb3defcd6cf2a01aea3b011a7cc51f

              • C:\Windows\rss\csrss.exe

                Filesize

                4.2MB

                MD5

                7e248f25f0af33ccd8993bd7f5c4a121

                SHA1

                c4cdb88b61822c245445e680d2369a9b5417cab8

                SHA256

                3c117306f10caded888705ff4e1d9b1a6023e1799724762e93f48c1c84fea503

                SHA512

                3d85d9cf79dce74e75a712fe2ae781a7859c380485d5c60f5a8de8f9e26639e5a8e66f6462f4effb7c2d6441668a6e7c03122f4275db3e931a8949891e55e7dc

              • C:\Windows\windefender.exe

                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              • memory/1932-286-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-280-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-278-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-276-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-274-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-294-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-268-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-282-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-264-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-284-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-292-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-288-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/1932-290-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/2660-1-0x0000000003D40000-0x0000000004143000-memory.dmp

                Filesize

                4.0MB

              • memory/2660-57-0x0000000003D40000-0x0000000004143000-memory.dmp

                Filesize

                4.0MB

              • memory/2660-3-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/2660-2-0x0000000004150000-0x0000000004A3B000-memory.dmp

                Filesize

                8.9MB

              • memory/2660-60-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/2660-58-0x0000000004150000-0x0000000004A3B000-memory.dmp

                Filesize

                8.9MB

              • memory/2748-273-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/2832-41-0x0000000007AD0000-0x0000000007AEE000-memory.dmp

                Filesize

                120KB

              • memory/2832-18-0x0000000005EB0000-0x0000000006204000-memory.dmp

                Filesize

                3.3MB

              • memory/2832-50-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

                Filesize

                104KB

              • memory/2832-51-0x0000000007C90000-0x0000000007C98000-memory.dmp

                Filesize

                32KB

              • memory/2832-54-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/2832-4-0x0000000004F30000-0x0000000004F66000-memory.dmp

                Filesize

                216KB

              • memory/2832-48-0x0000000007C30000-0x0000000007C3E000-memory.dmp

                Filesize

                56KB

              • memory/2832-47-0x0000000007BF0000-0x0000000007C01000-memory.dmp

                Filesize

                68KB

              • memory/2832-5-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/2832-46-0x0000000007CF0000-0x0000000007D86000-memory.dmp

                Filesize

                600KB

              • memory/2832-6-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/2832-7-0x00000000055B0000-0x0000000005BD8000-memory.dmp

                Filesize

                6.2MB

              • memory/2832-8-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/2832-9-0x0000000005530000-0x0000000005552000-memory.dmp

                Filesize

                136KB

              • memory/2832-10-0x0000000005C50000-0x0000000005CB6000-memory.dmp

                Filesize

                408KB

              • memory/2832-11-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                Filesize

                408KB

              • memory/2832-43-0x0000000007AF0000-0x0000000007B93000-memory.dmp

                Filesize

                652KB

              • memory/2832-49-0x0000000007C50000-0x0000000007C64000-memory.dmp

                Filesize

                80KB

              • memory/2832-22-0x0000000006500000-0x000000000651E000-memory.dmp

                Filesize

                120KB

              • memory/2832-42-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/2832-23-0x00000000065C0000-0x000000000660C000-memory.dmp

                Filesize

                304KB

              • memory/2832-24-0x0000000006A80000-0x0000000006AC4000-memory.dmp

                Filesize

                272KB

              • memory/2832-25-0x0000000007830000-0x00000000078A6000-memory.dmp

                Filesize

                472KB

              • memory/2832-26-0x0000000007F30000-0x00000000085AA000-memory.dmp

                Filesize

                6.5MB

              • memory/2832-45-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/2832-27-0x00000000078D0000-0x00000000078EA000-memory.dmp

                Filesize

                104KB

              • memory/2832-28-0x000000007EF50000-0x000000007EF60000-memory.dmp

                Filesize

                64KB

              • memory/2832-29-0x0000000007A90000-0x0000000007AC2000-memory.dmp

                Filesize

                200KB

              • memory/2832-30-0x00000000704F0000-0x000000007053C000-memory.dmp

                Filesize

                304KB

              • memory/2832-44-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

                Filesize

                40KB

              • memory/2832-31-0x0000000070C70000-0x0000000070FC4000-memory.dmp

                Filesize

                3.3MB

              • memory/3632-275-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/3632-279-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4156-126-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/4156-127-0x00000000026A0000-0x00000000026B0000-memory.dmp

                Filesize

                64KB

              • memory/4500-113-0x0000000070770000-0x0000000070AC4000-memory.dmp

                Filesize

                3.3MB

              • memory/4500-97-0x0000000002620000-0x0000000002630000-memory.dmp

                Filesize

                64KB

              • memory/4500-123-0x0000000002620000-0x0000000002630000-memory.dmp

                Filesize

                64KB

              • memory/4500-112-0x00000000705F0000-0x000000007063C000-memory.dmp

                Filesize

                304KB

              • memory/4500-111-0x000000007F7D0000-0x000000007F7E0000-memory.dmp

                Filesize

                64KB

              • memory/4500-125-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/4500-96-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/4500-108-0x0000000005720000-0x0000000005A74000-memory.dmp

                Filesize

                3.3MB

              • memory/4500-98-0x0000000002620000-0x0000000002630000-memory.dmp

                Filesize

                64KB

              • memory/4644-90-0x00000000074B0000-0x00000000074C1000-memory.dmp

                Filesize

                68KB

              • memory/4644-76-0x00000000705F0000-0x000000007063C000-memory.dmp

                Filesize

                304KB

              • memory/4644-94-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/4644-91-0x0000000007500000-0x0000000007514000-memory.dmp

                Filesize

                80KB

              • memory/4644-61-0x0000000074650000-0x0000000074E00000-memory.dmp

                Filesize

                7.7MB

              • memory/4644-88-0x0000000002600000-0x0000000002610000-memory.dmp

                Filesize

                64KB

              • memory/4644-89-0x0000000002600000-0x0000000002610000-memory.dmp

                Filesize

                64KB

              • memory/4644-87-0x0000000007190000-0x0000000007233000-memory.dmp

                Filesize

                652KB

              • memory/4644-77-0x0000000070790000-0x0000000070AE4000-memory.dmp

                Filesize

                3.3MB

              • memory/4644-62-0x0000000002600000-0x0000000002610000-memory.dmp

                Filesize

                64KB

              • memory/4644-75-0x000000007EF30000-0x000000007EF40000-memory.dmp

                Filesize

                64KB

              • memory/4644-74-0x0000000006070000-0x00000000060BC000-memory.dmp

                Filesize

                304KB

              • memory/4644-73-0x0000000005A70000-0x0000000005DC4000-memory.dmp

                Filesize

                3.3MB

              • memory/4644-63-0x0000000002600000-0x0000000002610000-memory.dmp

                Filesize

                64KB

              • memory/4852-110-0x0000000003B00000-0x0000000003F01000-memory.dmp

                Filesize

                4.0MB

              • memory/4852-160-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/4852-59-0x0000000000400000-0x0000000001E08000-memory.dmp

                Filesize

                26.0MB

              • memory/4852-56-0x0000000003B00000-0x0000000003F01000-memory.dmp

                Filesize

                4.0MB