Analysis

  • max time kernel
    128s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 20:06

General

  • Target

    b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe

  • Size

    4.2MB

  • MD5

    7811f765982ff3ca394c88179e364f11

  • SHA1

    25b4250522b4e48cc6c3c8cfd48242e7441f4bf4

  • SHA256

    b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d

  • SHA512

    02c7109a9ec34435feab5108687b01dedb8b14de492e8a3fa47dda55a4d0b9dff982932e16642c96696d30a82a89376bed0951f6a61dcbc4c3a9fe4d1aeae7cd

  • SSDEEP

    98304:B00QK3N3Jc8wpX9Ml+P+WnP01raAvqFLRTemOJzdkXG2:TpJcNpX++PyaASVpB6kP

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 16 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe
    "C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4548
    • C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe
      "C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3336
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5100
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3644
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2320
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3652
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3292
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2960
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
              PID:3136
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              4⤵
                PID:2164
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:4452
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                4⤵
                  PID:3836
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    5⤵
                      PID:4296
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        6⤵
                        • Launches sc.exe
                        PID:3044
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 780
                  3⤵
                  • Program crash
                  PID:3108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 868
                2⤵
                • Program crash
                PID:3776
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:2896
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3080 -ip 3080
                1⤵
                  PID:4680
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3060 -ip 3060
                  1⤵
                    PID:1324
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                      PID:1136

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uq4drtkw.2dc.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                            Filesize

                            281KB

                            MD5

                            d98e33b66343e7c96158444127a117f6

                            SHA1

                            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                            SHA256

                            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                            SHA512

                            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                            Filesize

                            2KB

                            MD5

                            968cb9309758126772781b83adb8a28f

                            SHA1

                            8da30e71accf186b2ba11da1797cf67f8f78b47c

                            SHA256

                            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                            SHA512

                            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            95bcd8b2eed118d5665ca422932d6970

                            SHA1

                            96fd70fc4c523d7cc3ae50562ae73fdc61e79b47

                            SHA256

                            f714b83f1253ad98448158324dcf6d31e1702b69d33c40c999b18274f5284906

                            SHA512

                            fda1d3c4abebf677fe448d0b1e9f61c4a0b79dd3df7508ea76b83284ab0e8dcd8155d063d5b024b629dfc1cf82abcc1e4404d466e26f1175a43d35be31a3fbb7

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            21eb6cefc3e5c1138ae2406f893273b8

                            SHA1

                            cb1107707886d71f2fa0c49096255a11046a4c64

                            SHA256

                            655542fecb3c757249449689060ce766355852eb223bb9aeda2007271c9d0687

                            SHA512

                            5d88af5d7100542dc0c4601da64e6dffc76baecaa758578de4b716641c91da14e32ad29e063a829a99e260361c11456b18decd0deadad6fdb2adb916e9c4df52

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            a080cf66771118656e44c63e1ce49e16

                            SHA1

                            7e71f8c9ed8b9e3bd74863d7fdbe3f344e9160fd

                            SHA256

                            691042dfa9bdd902b6a97be4e6d2a9e23223c22797070d4ad3832089450fd2ac

                            SHA512

                            8281954b8e19a0cd40b8b1b14d067614432f583bc756f6d899b7bb8d02191321a9a7b87bb0cda8c5c1db01a003fb3166acbdcd1980fb9480bd163d87f8e7c592

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            0475c4bf8a38bcf471bdb260976498d0

                            SHA1

                            a70191365f3677259269429b9e39494ad6f30428

                            SHA256

                            30c458ea9d3928065b5bbd6bf7e1a144191c63446bf5f50d98590994b9422698

                            SHA512

                            4aea4f816b44ba86cabbf6121c27ba10e8a569ca0cfaa0720d44fe08aaa175b17333b0dae91e8a85c38e56bdd13d052af34f95af88dcd0396d3ce0c33a1f6657

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                            Filesize

                            19KB

                            MD5

                            2b0f0928e921fcfa51626f3169f11af9

                            SHA1

                            bdae5ad50bb4175e1bde35089f2ce5f9f52e3b2e

                            SHA256

                            61e6830e80dbfa54c4d49568d2ae3c2e4de986cd1a6ce89a58e460009ce22dc7

                            SHA512

                            e890543d8871b21fb788a44f6cc2d8b01534e4641376f8d6c71ac071def086d5fdf1d001eae14064071195154935ce9f556d6e243fe95bd85c0080509af2ce5e

                          • C:\Windows\rss\csrss.exe

                            Filesize

                            4.2MB

                            MD5

                            7811f765982ff3ca394c88179e364f11

                            SHA1

                            25b4250522b4e48cc6c3c8cfd48242e7441f4bf4

                            SHA256

                            b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d

                            SHA512

                            02c7109a9ec34435feab5108687b01dedb8b14de492e8a3fa47dda55a4d0b9dff982932e16642c96696d30a82a89376bed0951f6a61dcbc4c3a9fe4d1aeae7cd

                          • C:\Windows\windefender.exe

                            Filesize

                            2.0MB

                            MD5

                            8e67f58837092385dcf01e8a2b4f5783

                            SHA1

                            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                            SHA256

                            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                            SHA512

                            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                          • memory/3060-119-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3060-68-0x0000000003C40000-0x000000000403F000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/3060-152-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3060-172-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3060-69-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3060-106-0x0000000003C40000-0x000000000403F000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/3060-103-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-63-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-10-0x0000000004170000-0x0000000004A5B000-memory.dmp

                            Filesize

                            8.9MB

                          • memory/3080-9-0x0000000003D60000-0x0000000004161000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/3080-84-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-1-0x0000000003D60000-0x0000000004161000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/3080-6-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-4-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-3-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3080-2-0x0000000004170000-0x0000000004A5B000-memory.dmp

                            Filesize

                            8.9MB

                          • memory/3080-38-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3836-282-0x0000000000400000-0x00000000008DF000-memory.dmp

                            Filesize

                            4.9MB

                          • memory/3968-275-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3968-207-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/3968-267-0x0000000000400000-0x0000000001E06000-memory.dmp

                            Filesize

                            26.0MB

                          • memory/4548-33-0x0000000006680000-0x00000000066CC000-memory.dmp

                            Filesize

                            304KB

                          • memory/4548-8-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

                            Filesize

                            216KB

                          • memory/4548-55-0x0000000007B90000-0x0000000007C33000-memory.dmp

                            Filesize

                            652KB

                          • memory/4548-56-0x0000000007C70000-0x0000000007C7A000-memory.dmp

                            Filesize

                            40KB

                          • memory/4548-57-0x0000000007D30000-0x0000000007DC6000-memory.dmp

                            Filesize

                            600KB

                          • memory/4548-58-0x0000000007C90000-0x0000000007CA1000-memory.dmp

                            Filesize

                            68KB

                          • memory/4548-59-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

                            Filesize

                            56KB

                          • memory/4548-60-0x0000000007CE0000-0x0000000007CF4000-memory.dmp

                            Filesize

                            80KB

                          • memory/4548-61-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

                            Filesize

                            104KB

                          • memory/4548-62-0x0000000007D10000-0x0000000007D18000-memory.dmp

                            Filesize

                            32KB

                          • memory/4548-44-0x00000000705E0000-0x0000000070934000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4548-66-0x00000000745A0000-0x0000000074D50000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4548-43-0x0000000070440000-0x000000007048C000-memory.dmp

                            Filesize

                            304KB

                          • memory/4548-42-0x0000000007AB0000-0x0000000007AE2000-memory.dmp

                            Filesize

                            200KB

                          • memory/4548-54-0x0000000007A90000-0x0000000007AAE000-memory.dmp

                            Filesize

                            120KB

                          • memory/4548-5-0x00000000745A0000-0x0000000074D50000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4548-7-0x00000000052A0000-0x00000000052B0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-36-0x00000000052A0000-0x00000000052B0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-11-0x00000000052A0000-0x00000000052B0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-41-0x000000007F360000-0x000000007F370000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-12-0x00000000058E0000-0x0000000005F08000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/4548-14-0x0000000005340000-0x0000000005362000-memory.dmp

                            Filesize

                            136KB

                          • memory/4548-15-0x0000000005660000-0x00000000056C6000-memory.dmp

                            Filesize

                            408KB

                          • memory/4548-16-0x0000000005740000-0x00000000057A6000-memory.dmp

                            Filesize

                            408KB

                          • memory/4548-17-0x00000000745A0000-0x0000000074D50000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4548-24-0x0000000005FD0000-0x0000000006324000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4548-29-0x00000000052A0000-0x00000000052B0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-40-0x0000000007A00000-0x0000000007A1A000-memory.dmp

                            Filesize

                            104KB

                          • memory/4548-39-0x0000000008040000-0x00000000086BA000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/4548-31-0x00000000052A0000-0x00000000052B0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4548-37-0x0000000007930000-0x00000000079A6000-memory.dmp

                            Filesize

                            472KB

                          • memory/4548-32-0x00000000065B0000-0x00000000065CE000-memory.dmp

                            Filesize

                            120KB

                          • memory/4548-35-0x0000000006BC0000-0x0000000006C04000-memory.dmp

                            Filesize

                            272KB

                          • memory/4672-70-0x00000000742C0000-0x0000000074A70000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4672-86-0x000000006FE80000-0x000000006FECC000-memory.dmp

                            Filesize

                            304KB

                          • memory/4672-71-0x0000000005140000-0x0000000005150000-memory.dmp

                            Filesize

                            64KB

                          • memory/4672-72-0x0000000005140000-0x0000000005150000-memory.dmp

                            Filesize

                            64KB

                          • memory/4672-73-0x0000000006000000-0x0000000006354000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4672-83-0x00000000067A0000-0x00000000067EC000-memory.dmp

                            Filesize

                            304KB

                          • memory/4672-85-0x0000000005140000-0x0000000005150000-memory.dmp

                            Filesize

                            64KB

                          • memory/4672-87-0x00000000708D0000-0x0000000070C24000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/4672-97-0x0000000007860000-0x0000000007903000-memory.dmp

                            Filesize

                            652KB

                          • memory/4672-98-0x0000000007B50000-0x0000000007B61000-memory.dmp

                            Filesize

                            68KB

                          • memory/4672-99-0x0000000007BC0000-0x0000000007BD4000-memory.dmp

                            Filesize

                            80KB

                          • memory/4672-102-0x00000000742C0000-0x0000000074A70000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/5100-105-0x00000000745A0000-0x0000000074D50000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/5100-108-0x0000000002700000-0x0000000002710000-memory.dmp

                            Filesize

                            64KB

                          • memory/5100-135-0x0000000006F30000-0x0000000006FD3000-memory.dmp

                            Filesize

                            652KB

                          • memory/5100-125-0x0000000070CE0000-0x0000000071034000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/5100-114-0x0000000005610000-0x0000000005964000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/5100-123-0x000000007F660000-0x000000007F670000-memory.dmp

                            Filesize

                            64KB

                          • memory/5100-124-0x0000000070540000-0x000000007058C000-memory.dmp

                            Filesize

                            304KB

                          • memory/5100-122-0x0000000002700000-0x0000000002710000-memory.dmp

                            Filesize

                            64KB

                          • memory/5100-121-0x0000000005D40000-0x0000000005D8C000-memory.dmp

                            Filesize

                            304KB

                          • memory/5100-107-0x0000000002700000-0x0000000002710000-memory.dmp

                            Filesize

                            64KB