glupteba | 795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693

Analysis

max time kernel
20s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe
Size

4.2MB
MD5

7fcc0c82ca8eeeb80276807af89b3f47
SHA1

b218f631c1bd0bc2370fa629eeb5153a7a129e59
SHA256

795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693
SHA512

47d1b2dd22a25aac77f4ee476fc57eaaf7a102def7018ac45288e47c8af444ed2342388b35054fe31a4c02a177f7761a761bec82b96cc1acd9b809014d203c6d
SSDEEP

98304:OFDX2D7KpLLzZSxNcqBsKAQPNaC1l72v7lGIQS:YyOpLXMxNjBsKAgF1kz8IN

Score

10^/10

glupteba dropper evasion loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/380-2-0x0000000006560000-0x0000000006E4B000-memory.dmp	family_glupteba
behavioral1/memory/380-23-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/380-51-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/380-55-0x0000000006560000-0x0000000006E4B000-memory.dmp	family_glupteba
behavioral1/memory/380-56-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4400-106-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4400-156-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-223-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-256-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-257-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-261-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-267-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-269-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-271-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-273-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba
behavioral1/memory/4324-275-0x0000000000400000-0x0000000004428000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

228 netsh.exe

pid	process
228	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/1356-266-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3392-268-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3392-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5080 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4408 4400 WerFault.exe 795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

708 schtasks.exe
416 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3248 powershell.exe
3248 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3248 powershell.exe

pid	process
5080	sc.exe

pid	pid_target	process	target process
4408	4400	WerFault.exe	795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe

pid	process
708	schtasks.exe
416	schtasks.exe

pid	process
3248	powershell.exe
3248	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3248	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe

description	pid	process	target process
PID 380 wrote to memory of 3248	380	795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe	powershell.exe
PID 380 wrote to memory of 3248	380	795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe	powershell.exe
PID 380 wrote to memory of 3248	380	795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe
"C:\Users\Admin\AppData\Local\Temp\795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Users\Admin\AppData\Local\Temp\795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe
"C:\Users\Admin\AppData\Local\Temp\795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693.exe"
2⤵
PID:4400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:616

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:1300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:3232

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
PID:4324

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:4212

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:708

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:4068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
PID:3588

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:416

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:2392

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 800
3⤵
- Program crash
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4400 -ip 4400
1⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:3968

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_or4yo3lz.hp0.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
efdef3e6df36a9aa1954ca049fde97ec

SHA1
27c1f73ddf281d4eea88257f9fe4617ec92b099d

SHA256
37c4109505b63fc12f020848cbc921b979bf60e512398843d3614e51419ae227

SHA512
330bdc9f0579dccb2618dd2d1297f59524d648fe0801ee537de5c4c5fc03fbdddcbb43a50b7fd4a496cd107e966b1e91df7ad45a36d37e7759b2b831fb2265f6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
efff908e97921347613bde31c2447b7e

SHA1
7454deb93de6b3851a6a7abaa04b3b13c0cfdb32

SHA256
457cea740b52f6a97a220fb9f96427a288364ae09734a2ffa8651f70d7c489a2

SHA512
d1baca7721775bdb8bd536458e343adf2f37b2c946d1d8082b85a908ca705e94cd2ec2283978adbd876f1582ca16cce884fbd5b448d03e88a05e313df551cccb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
142a8b7c8e25fde335fb1f567db36791

SHA1
88d4b9619588dedb4efbb1707444d9736cc76929

SHA256
ffa4cc337daf2a9bfcc215709e0924f8125b16c3202bef7f8a810878d6f30084

SHA512
05aa266dd0f73b69f8159059a097627485ac989127c8600d9c19cc8d6fab77192b3907ff38ecfe92a3d9d3215e1d4243737d218505a100d4bd73a27aa77575cb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
dfaff93d17c15e69ced507fec8b92f1d

SHA1
26f461f48c2fbb4e781497ba28666e8d1b5c1ed4

SHA256
999888dea1f3dc959160118a98c3d925edcb2a87639241d146c0db94ce77f65f

SHA512
f4d98f0800bd936ea64b886e9de7e06c738231d721ce33ba7ea5212447162b4bd3580b7fd4e039cd0d8bd5c51bc40d055d45192f993b3c343dfe63352eea8a04

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
9529b0da073499ddbabcaed15f4430e7

SHA1
c45044d668bd3c6fcce28f336bf84810766f0938

SHA256
c82adea40639d155c46a425172df7fabedd7236d243a6e4e76551dd236d830a2

SHA512
8050165c69c7f5c0aa52478fa5ac4273cc2cea6fcaf4092502f9645bfbdbe85dc1eae4e094a2444e6c87cba727af5e0181197a47690c297406691482fb6fe551

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
7fcc0c82ca8eeeb80276807af89b3f47

SHA1
b218f631c1bd0bc2370fa629eeb5153a7a129e59

SHA256
795fa896d54c6eed1eeb58c955e5a85a458d5fd85ccb1c7579998144360c5693

SHA512
47d1b2dd22a25aac77f4ee476fc57eaaf7a102def7018ac45288e47c8af444ed2342388b35054fe31a4c02a177f7761a761bec82b96cc1acd9b809014d203c6d

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/380-51-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/380-2-0x0000000006560000-0x0000000006E4B000-memory.dmp

Filesize
8.9MB

Download
memory/380-56-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/380-46-0x00000000049B0000-0x0000000004DB5000-memory.dmp

Filesize
4.0MB

Download
memory/380-1-0x00000000049B0000-0x0000000004DB5000-memory.dmp

Filesize
4.0MB

Download
memory/380-23-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/380-55-0x0000000006560000-0x0000000006E4B000-memory.dmp

Filesize
8.9MB

Download
memory/1300-109-0x00000000706F0000-0x000000007073C000-memory.dmp

Filesize
304KB

Download
memory/1300-94-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1300-92-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/1300-122-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/1300-110-0x0000000070EB0000-0x0000000071204000-memory.dmp

Filesize
3.3MB

Download
memory/1300-111-0x000000007F020000-0x000000007F030000-memory.dmp

Filesize
64KB

Download
memory/1300-93-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1300-104-0x0000000005BB0000-0x0000000005F04000-memory.dmp

Filesize
3.3MB

Download
memory/1300-107-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1356-266-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3232-137-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/3232-135-0x0000000005F40000-0x0000000006294000-memory.dmp

Filesize
3.3MB

Download
memory/3232-138-0x00000000706F0000-0x000000007073C000-memory.dmp

Filesize
304KB

Download
memory/3232-125-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/3232-124-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/3232-123-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/3232-139-0x0000000070B10000-0x0000000070E64000-memory.dmp

Filesize
3.3MB

Download
memory/3232-150-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/3248-41-0x0000000007B50000-0x0000000007B6E000-memory.dmp

Filesize
120KB

Download
memory/3248-26-0x0000000008050000-0x00000000086CA000-memory.dmp

Filesize
6.5MB

Download
memory/3248-3-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download
memory/3248-4-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/3248-5-0x0000000004FF0000-0x0000000005026000-memory.dmp

Filesize
216KB

Download
memory/3248-6-0x0000000005760000-0x0000000005D88000-memory.dmp

Filesize
6.2MB

Download
memory/3248-7-0x0000000005620000-0x0000000005642000-memory.dmp

Filesize
136KB

Download
memory/3248-8-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/3248-14-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Filesize
408KB

Download
memory/3248-19-0x0000000006060000-0x00000000063B4000-memory.dmp

Filesize
3.3MB

Download
memory/3248-20-0x0000000006670000-0x000000000668E000-memory.dmp

Filesize
120KB

Download
memory/3248-21-0x0000000006720000-0x000000000676C000-memory.dmp

Filesize
304KB

Download
memory/3248-22-0x00000000069E0000-0x0000000006A24000-memory.dmp

Filesize
272KB

Download
memory/3248-24-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/3248-25-0x0000000006C10000-0x0000000006C86000-memory.dmp

Filesize
472KB

Download
memory/3248-50-0x0000000007E90000-0x0000000007E98000-memory.dmp

Filesize
32KB

Download
memory/3248-49-0x0000000007EA0000-0x0000000007EBA000-memory.dmp

Filesize
104KB

Download
memory/3248-48-0x0000000007DB0000-0x0000000007DC4000-memory.dmp

Filesize
80KB

Download
memory/3248-47-0x0000000007D10000-0x0000000007D1E000-memory.dmp

Filesize
56KB

Download
memory/3248-45-0x0000000007CD0000-0x0000000007CE1000-memory.dmp

Filesize
68KB

Download
memory/3248-44-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Filesize
600KB

Download
memory/3248-27-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

Filesize
104KB

Download
memory/3248-43-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Filesize
40KB

Download
memory/3248-54-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download
memory/3248-42-0x0000000007BB0000-0x0000000007C53000-memory.dmp

Filesize
652KB

Download
memory/3248-31-0x0000000070770000-0x0000000070AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3248-30-0x00000000705F0000-0x000000007063C000-memory.dmp

Filesize
304KB

Download
memory/3248-29-0x0000000007B70000-0x0000000007BA2000-memory.dmp

Filesize
200KB

Download
memory/3248-28-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/3392-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3392-268-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4324-269-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-223-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-273-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-277-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-271-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-256-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-257-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-261-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-275-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4324-267-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4400-106-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4400-58-0x0000000004990000-0x0000000004D97000-memory.dmp

Filesize
4.0MB

Download
memory/4400-156-0x0000000000400000-0x0000000004428000-memory.dmp

Filesize
64.2MB

Download
memory/4400-108-0x0000000004990000-0x0000000004D97000-memory.dmp

Filesize
4.0MB

Download
memory/4696-74-0x00000000706F0000-0x000000007073C000-memory.dmp

Filesize
304KB

Download
memory/4696-61-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4696-60-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4696-59-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-67-0x0000000005D70000-0x00000000060C4000-memory.dmp

Filesize
3.3MB

Download
memory/4696-72-0x0000000006450000-0x000000000649C000-memory.dmp

Filesize
304KB

Download
memory/4696-73-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4696-75-0x0000000070E90000-0x00000000711E4000-memory.dmp

Filesize
3.3MB

Download
memory/4696-85-0x00000000075E0000-0x0000000007683000-memory.dmp

Filesize
652KB

Download
memory/4696-86-0x0000000007900000-0x0000000007911000-memory.dmp

Filesize
68KB

Download
memory/4696-87-0x0000000007950000-0x0000000007964000-memory.dmp

Filesize
80KB

Download
memory/4696-90-0x00000000747F0000-0x0000000074FA0000-memory.dmp

Filesize
7.7MB

Download