glupteba | 27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570

Analysis

max time kernel
8s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
Size

4.2MB
MD5

06fde9329ba637a126edd0face3dc26e
SHA1

c4a933b6490857cee424ab6712c59b6977154ca2
SHA256

27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570
SHA512

9f14af6ac0f23249f92157e0edf9b6a87d63d0340a24e92aff71820aac041dc45df1c0fae4b4870a1eb7b09c2a698241ea61af6e8bdead2cbcef5414ffeeadcb
SSDEEP

98304:JlPNnLMcliXgk6mZUGEiVLqbbhuqLV4AlEjP7K:JlP9LMc0wkDbEiV0LVIm

Score

10^/10

glupteba dropper evasion loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3108-2-0x00000000050E0000-0x00000000059CB000-memory.dmp	family_glupteba
behavioral1/memory/3108-3-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3108-5-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3108-31-0x00000000050E0000-0x00000000059CB000-memory.dmp	family_glupteba
behavioral1/memory/3108-51-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3108-59-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3896-61-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3896-96-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/3896-159-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/4292-228-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/4292-262-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/4292-271-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba
behavioral1/memory/4292-273-0x0000000000400000-0x000000000300B000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3964 netsh.exe

pid	process
3964	netsh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral1/memory/1944-270-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1120-272-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4472 sc.exe

pid	process
4472	sc.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3584	3108	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
2760	3108	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
1176	3108	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
2184	3896	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
4928	3896	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
2616	3896	WerFault.exe	27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1504 schtasks.exe
556 schtasks.exe

pid	process
1504	schtasks.exe
556	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
"C:\Users\Admin\AppData\Local\Temp\27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe"
1⤵
PID:3108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
PID:4704

C:\Users\Admin\AppData\Local\Temp\27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe
"C:\Users\Admin\AppData\Local\Temp\27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570.exe"
2⤵
PID:3896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:2932

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:4696

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:2352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:1884

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
PID:4292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:4380

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3652

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
PID:3964

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:556

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:2220

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 680
3⤵
- Program crash
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 828
3⤵
- Program crash
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 600
3⤵
- Program crash
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 812
2⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 900
2⤵
- Program crash
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 676
2⤵
- Program crash
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3108 -ip 3108
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3108 -ip 3108
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3108 -ip 3108
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3896 -ip 3896
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3896 -ip 3896
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3896 -ip 3896
1⤵
PID:1280

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohcvhksl.ysf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b93991f49ad9de026e61a163d863562d

SHA1
a9cce98a220be8501c75c9469369a9b662bc1483

SHA256
f59ac6fe109b35ffc72d32305181955dda3ea354c42cb761125798e8dad7b630

SHA512
c45c5c94281e77e0bdcf0742db532dee659ff93d32ae441eb6e0bd7194c8e206c022da9dce2b422121659dd1351a2dbe546d24a4fd78d9b6fefc96582fd08bf8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
71aa1db78816bcbbb00fad11c736fd07

SHA1
25f8bfa389626fcd186fa736ea72c8ff8bb09f5c

SHA256
f58d2f75a5452f87d6d83f7da797fb785774f02a90765ce9ae67312ee7e52333

SHA512
3a30fd3e560eac172307846000266e31de57e8e822cd010246ca4883dcdb7f9b73b5bcadd3eb0c377c4fd567e41c9d83ffb14d59c880a0ef9613b85d44094bdc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
c748d780a995991c9589642d8949784c

SHA1
b5bedc746ec193d7ba134cf896ff999d99c9666f

SHA256
f2d7281d81ff2adef28ba942e1f9fe290793d7c4ad34be4755d4557d58d5b5b4

SHA512
85b1ee9256f726fa607b506d71129c4a92231c9c520fc145f02def10e42c4845b11d2a875b3ebfeb17954bbd58a41818dff12e692908356ad77f3b15adf9a059

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
620025430f51595e05f6ea203b216c7b

SHA1
7044a7f0e41f5c68175c4275519fc4ad5d2d0773

SHA256
f7d517c73226b41ae4cd4de8eb1d991c53c1285cea5f50d534c50313b1881cd5

SHA512
96d3f02f0b56776a3d306643bc9c74bccc6d597488965bc4e6ddd355ea60f66983e69a6d16a23a2c7ae1ca00898d1eadb298548fc921744ccf247d49c23aadc7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
2408727976f4f3780c5a36245a1c970f

SHA1
cf40e5cad4e5b5d547b02586be2af6464e8773e9

SHA256
cdc54465748865908a35843c21c0abce3feb55ab724a073adf6fd19fc1ed4f6c

SHA512
adfb141434d5b7ffb53f039a5edd2f9599840eff76c798dc1c249fa817c84fbb51c27872205c7793964b6259a47ee1955e42d0eab32ed65449516ee627149102

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
06fde9329ba637a126edd0face3dc26e

SHA1
c4a933b6490857cee424ab6712c59b6977154ca2

SHA256
27e8af88f2dcbd8524cde08aaf09a357c2ee3a4ce1e4f34c2a295df820c58570

SHA512
9f14af6ac0f23249f92157e0edf9b6a87d63d0340a24e92aff71820aac041dc45df1c0fae4b4870a1eb7b09c2a698241ea61af6e8bdead2cbcef5414ffeeadcb

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1120-272-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1884-140-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/1884-138-0x0000000006230000-0x0000000006584000-memory.dmp

Filesize
3.3MB

Download
memory/1884-127-0x0000000074180000-0x0000000074930000-memory.dmp

Filesize
7.7MB

Download
memory/1884-128-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/1944-270-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2352-126-0x0000000074180000-0x0000000074930000-memory.dmp

Filesize
7.7MB

Download
memory/2352-114-0x0000000070840000-0x0000000070B94000-memory.dmp

Filesize
3.3MB

Download
memory/2352-113-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/2352-112-0x0000000000910000-0x0000000000920000-memory.dmp

Filesize
64KB

Download
memory/2352-124-0x000000007F080000-0x000000007F090000-memory.dmp

Filesize
64KB

Download
memory/2352-98-0x0000000000910000-0x0000000000920000-memory.dmp

Filesize
64KB

Download
memory/2352-99-0x0000000005660000-0x00000000059B4000-memory.dmp

Filesize
3.3MB

Download
memory/2352-100-0x0000000000910000-0x0000000000920000-memory.dmp

Filesize
64KB

Download
memory/2352-97-0x0000000074180000-0x0000000074930000-memory.dmp

Filesize
7.7MB

Download
memory/2932-62-0x0000000074180000-0x0000000074930000-memory.dmp

Filesize
7.7MB

Download
memory/2932-63-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2932-75-0x0000000006440000-0x000000000648C000-memory.dmp

Filesize
304KB

Download
memory/2932-70-0x0000000005890000-0x0000000005BE4000-memory.dmp

Filesize
3.3MB

Download
memory/2932-64-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2932-76-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2932-79-0x0000000070820000-0x0000000070B74000-memory.dmp

Filesize
3.3MB

Download
memory/2932-94-0x0000000074180000-0x0000000074930000-memory.dmp

Filesize
7.7MB

Download
memory/2932-91-0x0000000007410000-0x0000000007424000-memory.dmp

Filesize
80KB

Download
memory/2932-78-0x0000000070080000-0x00000000700CC000-memory.dmp

Filesize
304KB

Download
memory/2932-90-0x00000000073C0000-0x00000000073D1000-memory.dmp

Filesize
68KB

Download
memory/2932-89-0x00000000070E0000-0x0000000007183000-memory.dmp

Filesize
652KB

Download
memory/2932-77-0x000000007F1E0000-0x000000007F1F0000-memory.dmp

Filesize
64KB

Download
memory/3108-59-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3108-51-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3108-26-0x0000000003530000-0x0000000003931000-memory.dmp

Filesize
4.0MB

Download
memory/3108-5-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3108-1-0x0000000003530000-0x0000000003931000-memory.dmp

Filesize
4.0MB

Download
memory/3108-3-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3108-31-0x00000000050E0000-0x00000000059CB000-memory.dmp

Filesize
8.9MB

Download
memory/3108-2-0x00000000050E0000-0x00000000059CB000-memory.dmp

Filesize
8.9MB

Download
memory/3896-96-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3896-101-0x00000000035B0000-0x00000000039B3000-memory.dmp

Filesize
4.0MB

Download
memory/3896-60-0x00000000035B0000-0x00000000039B3000-memory.dmp

Filesize
4.0MB

Download
memory/3896-159-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/3896-61-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/4292-273-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/4292-271-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/4292-262-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/4292-228-0x0000000000400000-0x000000000300B000-memory.dmp

Filesize
44.0MB

Download
memory/4704-25-0x0000000006B90000-0x0000000006BD4000-memory.dmp

Filesize
272KB

Download
memory/4704-12-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Filesize
408KB

Download
memory/4704-32-0x0000000007BB0000-0x0000000007BE2000-memory.dmp

Filesize
200KB

Download
memory/4704-33-0x000000007F290000-0x000000007F2A0000-memory.dmp

Filesize
64KB

Download
memory/4704-46-0x0000000007BF0000-0x0000000007C93000-memory.dmp

Filesize
652KB

Download
memory/4704-30-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/4704-29-0x0000000008060000-0x00000000086DA000-memory.dmp

Filesize
6.5MB

Download
memory/4704-28-0x0000000007960000-0x00000000079D6000-memory.dmp

Filesize
472KB

Download
memory/4704-27-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/4704-49-0x0000000007D00000-0x0000000007D11000-memory.dmp

Filesize
68KB

Download
memory/4704-45-0x0000000007B90000-0x0000000007BAE000-memory.dmp

Filesize
120KB

Download
memory/4704-24-0x0000000006750000-0x000000000679C000-memory.dmp

Filesize
304KB

Download
memory/4704-23-0x00000000066C0000-0x00000000066DE000-memory.dmp

Filesize
120KB

Download
memory/4704-18-0x0000000005FB0000-0x0000000006304000-memory.dmp

Filesize
3.3MB

Download
memory/4704-11-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/4704-35-0x0000000070720000-0x0000000070A74000-memory.dmp

Filesize
3.3MB

Download
memory/4704-10-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/4704-9-0x00000000057A0000-0x0000000005DC8000-memory.dmp

Filesize
6.2MB

Download
memory/4704-50-0x0000000007D40000-0x0000000007D4E000-memory.dmp

Filesize
56KB

Download
memory/4704-7-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/4704-8-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/4704-52-0x0000000007D50000-0x0000000007D64000-memory.dmp

Filesize
80KB

Download
memory/4704-48-0x0000000007DA0000-0x0000000007E36000-memory.dmp

Filesize
600KB

Download
memory/4704-6-0x0000000003020000-0x0000000003056000-memory.dmp

Filesize
216KB

Download
memory/4704-53-0x0000000007E40000-0x0000000007E5A000-memory.dmp

Filesize
104KB

Download
memory/4704-4-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/4704-47-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Filesize
40KB

Download
memory/4704-54-0x0000000007D80000-0x0000000007D88000-memory.dmp

Filesize
32KB

Download
memory/4704-34-0x000000006FF80000-0x000000006FFCC000-memory.dmp

Filesize
304KB

Download
memory/4704-57-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download