Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 20:05

General

  • Target

    07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14.exe

  • Size

    4.2MB

  • MD5

    d08a89716dfc10241358be5cd12c12c7

  • SHA1

    a1499b609197316bef4200c25969d105a231896d

  • SHA256

    07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14

  • SHA512

    2c0dbc61276c63138332722c5dccef7fa1d2ad53362d5d15b5ee4b40aa852c14085f334085d2876198b0940df9b63b4de345c5881804273d595f9481595eaf14

  • SSDEEP

    98304:500QK3N3Jc8wpX9Ml+P+WnP01raAvqFLRTemOJzdkXGZ:7pJcNpX++PyaASVpB6k4

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14.exe
    "C:\Users\Admin\AppData\Local\Temp\07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Users\Admin\AppData\Local\Temp\07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14.exe
      "C:\Users\Admin\AppData\Local\Temp\07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4564
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4968
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3028
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1392
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4296
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4700
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4580
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              5⤵
                PID:4968
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:116
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5080
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2480
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:4296
            • C:\Windows\windefender.exe
              "C:\Windows\windefender.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4780
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2292
                • C:\Windows\SysWOW64\sc.exe
                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  6⤵
                  • Launches sc.exe
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3824
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 932
          2⤵
          • Program crash
          PID:3024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3580 -ip 3580
        1⤵
          PID:1940
        • C:\Windows\windefender.exe
          C:\Windows\windefender.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:4788

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxlovsa4.jha.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                968cb9309758126772781b83adb8a28f

                SHA1

                8da30e71accf186b2ba11da1797cf67f8f78b47c

                SHA256

                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                SHA512

                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                eabd7dc98b51af67f75f6bbecf9f3dae

                SHA1

                0ded0232757cd67102106523e1b2a54f50794cb4

                SHA256

                598e9b95ba4f2fa13df12485c9d65636d0ac4a85c9731abd617d44b4825588b9

                SHA512

                6ecc420796926768500e2de7d2f38b962cdee8f6564cdffba250b320e3fb597ac30997f261bad491ab1e185b79c5c385f73cb1c64a28aef29b3b97c4d242c4cc

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                cd280675f29e789921f51fb858ad581c

                SHA1

                d5ca214121883cbe64693ca43259291d841de67e

                SHA256

                7c146ec6acf735fbf9060671c63f3adc6f60d5d6aad71e6caf8eda733f226ec8

                SHA512

                156e1c17fbddb0e4e6d250d8bfd22517891819c0bf4ec362c8d1663ce4ceef5980acfb8252d9eea56d7062f4e4de62ad4ae1a24076f3e95556553d4c7898492a

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                0e63e755803fede5a70167ee1bd3ad25

                SHA1

                db6e7868091bbf99953347657c368654f48de06d

                SHA256

                1440cdb3098b0e4566cd003b1e9ec639305d00323e14bc76525b3d9d65ddb1f7

                SHA512

                80cf86463f42bfde1ee2e2044fdcaf6dcbb27462842c16d12e95262f7dfb60746545239a3b785b2dde9827dc306934475baad41afe51ef56bc50a447b9b011bb

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                fef0433e2a5886e60f454630e10e37fa

                SHA1

                932b6fdd0a5bd24a71aeee99656e586e2efd8d18

                SHA256

                9a6e8bc4e8b031d1fa3bd690119eb316d9a3d8f059fcf82bf69fa8f6539063c5

                SHA512

                aa888db196584e0f74ccc636fa9f42cd3a2b68ca3370caf3e1468bdfabc594b87d95cf1d53ec900a2753cdc270a33b4efb64c207aa4e5eef1936d193a9ba1d5a

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                96d0d1ac90d2a2dba3c88d86954419a8

                SHA1

                df0f293233c391cff882fa7ad3c18848f3c10125

                SHA256

                bfe0608338727fef3697e23b5884a252bcce0ce0dc5740cf10fdb65f127371ab

                SHA512

                b29cd76a5e0a7fd66660cf19a9c153d430fb729f3874596edded03adc2d29e30d4f97aa721c291b937bcb441bafa2f9ee6a21a60ec6a6b6c4ba1a3de7991e030

              • C:\Windows\rss\csrss.exe

                Filesize

                4.2MB

                MD5

                d08a89716dfc10241358be5cd12c12c7

                SHA1

                a1499b609197316bef4200c25969d105a231896d

                SHA256

                07facf9e00672d2658749188db1a1998dfdf74e5810ac00c845e0ce83ecd9b14

                SHA512

                2c0dbc61276c63138332722c5dccef7fa1d2ad53362d5d15b5ee4b40aa852c14085f334085d2876198b0940df9b63b4de345c5881804273d595f9481595eaf14

              • C:\Windows\windefender.exe

                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              • memory/1392-137-0x0000000070C20000-0x0000000070F74000-memory.dmp

                Filesize

                3.3MB

              • memory/1392-122-0x0000000074580000-0x0000000074D30000-memory.dmp

                Filesize

                7.7MB

              • memory/1392-123-0x0000000005180000-0x0000000005190000-memory.dmp

                Filesize

                64KB

              • memory/1392-124-0x0000000005180000-0x0000000005190000-memory.dmp

                Filesize

                64KB

              • memory/1392-136-0x0000000070480000-0x00000000704CC000-memory.dmp

                Filesize

                304KB

              • memory/1904-26-0x00000000073F0000-0x000000000740A000-memory.dmp

                Filesize

                104KB

              • memory/1904-48-0x0000000007760000-0x0000000007774000-memory.dmp

                Filesize

                80KB

              • memory/1904-24-0x0000000007140000-0x00000000071B6000-memory.dmp

                Filesize

                472KB

              • memory/1904-28-0x000000007F730000-0x000000007F740000-memory.dmp

                Filesize

                64KB

              • memory/1904-27-0x00000000075A0000-0x00000000075D2000-memory.dmp

                Filesize

                200KB

              • memory/1904-29-0x0000000070380000-0x00000000703CC000-memory.dmp

                Filesize

                304KB

              • memory/1904-30-0x0000000070500000-0x0000000070854000-memory.dmp

                Filesize

                3.3MB

              • memory/1904-41-0x00000000075E0000-0x00000000075FE000-memory.dmp

                Filesize

                120KB

              • memory/1904-40-0x0000000004D00000-0x0000000004D10000-memory.dmp

                Filesize

                64KB

              • memory/1904-42-0x0000000007600000-0x00000000076A3000-memory.dmp

                Filesize

                652KB

              • memory/1904-43-0x00000000076F0000-0x00000000076FA000-memory.dmp

                Filesize

                40KB

              • memory/1904-44-0x0000000004D00000-0x0000000004D10000-memory.dmp

                Filesize

                64KB

              • memory/1904-45-0x0000000007800000-0x0000000007896000-memory.dmp

                Filesize

                600KB

              • memory/1904-46-0x0000000007700000-0x0000000007711000-memory.dmp

                Filesize

                68KB

              • memory/1904-47-0x0000000007740000-0x000000000774E000-memory.dmp

                Filesize

                56KB

              • memory/1904-23-0x0000000006590000-0x00000000065D4000-memory.dmp

                Filesize

                272KB

              • memory/1904-49-0x00000000077B0000-0x00000000077CA000-memory.dmp

                Filesize

                104KB

              • memory/1904-50-0x00000000077A0000-0x00000000077A8000-memory.dmp

                Filesize

                32KB

              • memory/1904-53-0x00000000744E0000-0x0000000074C90000-memory.dmp

                Filesize

                7.7MB

              • memory/1904-4-0x0000000002A40000-0x0000000002A76000-memory.dmp

                Filesize

                216KB

              • memory/1904-5-0x00000000744E0000-0x0000000074C90000-memory.dmp

                Filesize

                7.7MB

              • memory/1904-6-0x0000000004D00000-0x0000000004D10000-memory.dmp

                Filesize

                64KB

              • memory/1904-7-0x0000000005340000-0x0000000005968000-memory.dmp

                Filesize

                6.2MB

              • memory/1904-8-0x0000000005060000-0x0000000005082000-memory.dmp

                Filesize

                136KB

              • memory/1904-9-0x0000000005100000-0x0000000005166000-memory.dmp

                Filesize

                408KB

              • memory/1904-10-0x0000000005970000-0x00000000059D6000-memory.dmp

                Filesize

                408KB

              • memory/1904-25-0x0000000007A70000-0x00000000080EA000-memory.dmp

                Filesize

                6.5MB

              • memory/1904-20-0x0000000005AE0000-0x0000000005E34000-memory.dmp

                Filesize

                3.3MB

              • memory/1904-21-0x0000000006020000-0x000000000603E000-memory.dmp

                Filesize

                120KB

              • memory/1904-22-0x0000000006060000-0x00000000060AC000-memory.dmp

                Filesize

                304KB

              • memory/3028-95-0x0000000002E40000-0x0000000002E50000-memory.dmp

                Filesize

                64KB

              • memory/3028-96-0x0000000002E40000-0x0000000002E50000-memory.dmp

                Filesize

                64KB

              • memory/3028-121-0x0000000074580000-0x0000000074D30000-memory.dmp

                Filesize

                7.7MB

              • memory/3028-107-0x000000007F520000-0x000000007F530000-memory.dmp

                Filesize

                64KB

              • memory/3028-109-0x0000000070C20000-0x0000000070F74000-memory.dmp

                Filesize

                3.3MB

              • memory/3028-119-0x0000000002E40000-0x0000000002E50000-memory.dmp

                Filesize

                64KB

              • memory/3028-108-0x0000000070480000-0x00000000704CC000-memory.dmp

                Filesize

                304KB

              • memory/3028-94-0x0000000074580000-0x0000000074D30000-memory.dmp

                Filesize

                7.7MB

              • memory/3580-274-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-281-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-266-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-279-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-273-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-271-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-256-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-268-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-265-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-276-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-282-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-284-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-286-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-55-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-56-0x0000000003CC0000-0x00000000040B9000-memory.dmp

                Filesize

                4.0MB

              • memory/3580-1-0x0000000003CC0000-0x00000000040B9000-memory.dmp

                Filesize

                4.0MB

              • memory/3580-3-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3580-2-0x00000000040C0000-0x00000000049AB000-memory.dmp

                Filesize

                8.9MB

              • memory/3944-135-0x0000000003B80000-0x0000000003F80000-memory.dmp

                Filesize

                4.0MB

              • memory/3944-154-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3944-58-0x0000000003F80000-0x000000000486B000-memory.dmp

                Filesize

                8.9MB

              • memory/3944-59-0x0000000000400000-0x0000000001E06000-memory.dmp

                Filesize

                26.0MB

              • memory/3944-57-0x0000000003B80000-0x0000000003F80000-memory.dmp

                Filesize

                4.0MB

              • memory/4564-87-0x0000000007750000-0x00000000077F3000-memory.dmp

                Filesize

                652KB

              • memory/4564-74-0x000000007F200000-0x000000007F210000-memory.dmp

                Filesize

                64KB

              • memory/4564-86-0x00000000052D0000-0x00000000052E0000-memory.dmp

                Filesize

                64KB

              • memory/4564-88-0x0000000007A70000-0x0000000007A81000-memory.dmp

                Filesize

                68KB

              • memory/4564-89-0x0000000007AC0000-0x0000000007AD4000-memory.dmp

                Filesize

                80KB

              • memory/4564-75-0x0000000070480000-0x00000000704CC000-memory.dmp

                Filesize

                304KB

              • memory/4564-92-0x0000000074580000-0x0000000074D30000-memory.dmp

                Filesize

                7.7MB

              • memory/4564-76-0x0000000070C20000-0x0000000070F74000-memory.dmp

                Filesize

                3.3MB

              • memory/4564-73-0x0000000006AB0000-0x0000000006AFC000-memory.dmp

                Filesize

                304KB

              • memory/4564-72-0x0000000005F40000-0x0000000006294000-memory.dmp

                Filesize

                3.3MB

              • memory/4564-60-0x0000000074580000-0x0000000074D30000-memory.dmp

                Filesize

                7.7MB

              • memory/4564-61-0x00000000052D0000-0x00000000052E0000-memory.dmp

                Filesize

                64KB

              • memory/4564-62-0x00000000052D0000-0x00000000052E0000-memory.dmp

                Filesize

                64KB

              • memory/4780-264-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4788-270-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4788-267-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB