Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-05-2024 15:14

General

  • Target

    eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135.exe

  • Size

    4.1MB

  • MD5

    60ce4b5a82eb7916d6909e29dd7f8178

  • SHA1

    b0166f15533bdd19d2588cb52fc146e79750982e

  • SHA256

    eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135

  • SHA512

    07c1783183e4f460566571f19258ed537c0a664d6757c9dc4f269c9b6918ecd6430848af362b7c5f4c606e078af86c473abe9e38134b0bd3d778d99a092bab32

  • SSDEEP

    98304:CoJ/zNpfNOjfVFQ/nccBDV6mYf0gdQtHi3wo8k3cC1G76/iQ:CgrNPOj9FQvccBDkmyddxD3VFiQ

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135.exe
    "C:\Users\Admin\AppData\Local\Temp\eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Users\Admin\AppData\Local\Temp\eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135.exe
      "C:\Users\Admin\AppData\Local\Temp\eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:480
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3528
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4748
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2124
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:2880
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4488
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2428
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4884
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:1404
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2212
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:8
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4496
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:3164

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5uxvacgp.d1s.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      ac4917a885cf6050b1a483e4bc4d2ea5

      SHA1

      b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

      SHA256

      e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

      SHA512

      092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      09dd40e8a4ec27c89a6038433a2976b9

      SHA1

      6fa5d4b76aca9749a64b94bc6f22f303ac62d37e

      SHA256

      55b7f6bcb3b58ad75b8f5d4b53999635b29204f74e53901b140f9ad301e7cf44

      SHA512

      1f54c16445528fe0435a71cf3301945a6336a3baf33a8accf8e8096e9a158666fad0745ef1967dc2aa5219f3e0a26cdf50e5ae9837ff62484032451edd94947a

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      db4053786936409512ba71ec119cd1d8

      SHA1

      e2adb280647759ae85bf0e357f83e718c90831ca

      SHA256

      9f19138c5c0fcd6b27ef694b10b0fb699dbcae88321331bfc9db3032233f8387

      SHA512

      7431d5e6f2efa4a4e848cf1c7c8aca873a2a9261292c3987ae6d9ffa50e069b5667914c9b876b1cc9cb79d007a5a64ee9a0abf2229f30940c2c7ab410662705d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      93a0e3c0b38fbaae08b4213bfe8fc7ec

      SHA1

      95dbf14528dfceb17b5a6840ccf405644b0e331e

      SHA256

      a89693faece905b303c3462eb66d0b3f31ea92b725525167792d60bb8cfe5518

      SHA512

      1fb99752820a4ad7c62d65ea0c95b5c17f04108b55b77d0bff1fd5b7f4baa45302f4c15b530f7d2e4a1ea2f0304935f76be0cf63ede4c6904ea508a44e457bc9

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      f23d52dcc16f3f6f303c812a45766f62

      SHA1

      4689f66cb353f0cf4be0fa38c1793fd69f5b0129

      SHA256

      8aa13abbd581c379a1ef81580d55030c8e37ed0f18e89f3486edf730c4885598

      SHA512

      7fc809082aafb63262d491aeefca503ce83259c7ae3273c2e322b83b45814032a1f55694666935cb51037049505bd08ce711c50435bc601491bd29c5435e8c55

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      53b773cd685365d4480a621f22a5ed61

      SHA1

      0a0018aadc0bdf5ef797a400a24c94dfb009ce32

      SHA256

      5b6d7497873cee8bbf34553c725bf769ff6de59cba6c3e7d71d3f2d61c5147a7

      SHA512

      35c66c4f961ce5b6aece0a9a5308fa8bd0340b89496052fc642072f2dbd6a24ce41d6918815754b415a752031b02dc2df0aafc0e6b3d9c8d5766e628be34f349

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      60ce4b5a82eb7916d6909e29dd7f8178

      SHA1

      b0166f15533bdd19d2588cb52fc146e79750982e

      SHA256

      eb00a4ce951ec47964dfa30070eb9ebe429c90e44585e8878afbde76b3799135

      SHA512

      07c1783183e4f460566571f19258ed537c0a664d6757c9dc4f269c9b6918ecd6430848af362b7c5f4c606e078af86c473abe9e38134b0bd3d778d99a092bab32

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/1856-78-0x0000000007170000-0x0000000007181000-memory.dmp

      Filesize

      68KB

    • memory/1856-79-0x00000000071C0000-0x00000000071D5000-memory.dmp

      Filesize

      84KB

    • memory/1856-64-0x00000000057E0000-0x0000000005B37000-memory.dmp

      Filesize

      3.3MB

    • memory/1856-77-0x0000000006E50000-0x0000000006EF4000-memory.dmp

      Filesize

      656KB

    • memory/1856-68-0x0000000070760000-0x0000000070AB7000-memory.dmp

      Filesize

      3.3MB

    • memory/1856-67-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/2212-210-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/2212-214-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/2428-186-0x0000000006420000-0x0000000006777000-memory.dmp

      Filesize

      3.3MB

    • memory/2428-190-0x0000000070660000-0x00000000709B7000-memory.dmp

      Filesize

      3.3MB

    • memory/2428-189-0x00000000704E0000-0x000000007052C000-memory.dmp

      Filesize

      304KB

    • memory/3164-213-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3164-218-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3164-223-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3244-92-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/3244-93-0x0000000070740000-0x0000000070A97000-memory.dmp

      Filesize

      3.3MB

    • memory/3512-39-0x0000000074350000-0x0000000074B01000-memory.dmp

      Filesize

      7.7MB

    • memory/3512-36-0x00000000071B0000-0x00000000071CE000-memory.dmp

      Filesize

      120KB

    • memory/3512-44-0x0000000007370000-0x0000000007381000-memory.dmp

      Filesize

      68KB

    • memory/3512-45-0x00000000073B0000-0x00000000073BE000-memory.dmp

      Filesize

      56KB

    • memory/3512-46-0x00000000073C0000-0x00000000073D5000-memory.dmp

      Filesize

      84KB

    • memory/3512-47-0x00000000074C0000-0x00000000074DA000-memory.dmp

      Filesize

      104KB

    • memory/3512-48-0x00000000074A0000-0x00000000074A8000-memory.dmp

      Filesize

      32KB

    • memory/3512-51-0x0000000074350000-0x0000000074B01000-memory.dmp

      Filesize

      7.7MB

    • memory/3512-10-0x0000000074350000-0x0000000074B01000-memory.dmp

      Filesize

      7.7MB

    • memory/3512-11-0x0000000005840000-0x00000000058A6000-memory.dmp

      Filesize

      408KB

    • memory/3512-20-0x00000000058B0000-0x0000000005C07000-memory.dmp

      Filesize

      3.3MB

    • memory/3512-42-0x0000000007340000-0x000000000734A000-memory.dmp

      Filesize

      40KB

    • memory/3512-8-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

      Filesize

      136KB

    • memory/3512-7-0x0000000074350000-0x0000000074B01000-memory.dmp

      Filesize

      7.7MB

    • memory/3512-41-0x0000000007300000-0x000000000731A000-memory.dmp

      Filesize

      104KB

    • memory/3512-40-0x0000000007940000-0x0000000007FBA000-memory.dmp

      Filesize

      6.5MB

    • memory/3512-43-0x0000000007400000-0x0000000007496000-memory.dmp

      Filesize

      600KB

    • memory/3512-6-0x0000000005000000-0x000000000562A000-memory.dmp

      Filesize

      6.2MB

    • memory/3512-38-0x0000000074350000-0x0000000074B01000-memory.dmp

      Filesize

      7.7MB

    • memory/3512-27-0x0000000070740000-0x0000000070A97000-memory.dmp

      Filesize

      3.3MB

    • memory/3512-37-0x00000000071D0000-0x0000000007274000-memory.dmp

      Filesize

      656KB

    • memory/3512-9-0x0000000005720000-0x0000000005786000-memory.dmp

      Filesize

      408KB

    • memory/3512-26-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/3512-5-0x0000000002890000-0x00000000028C6000-memory.dmp

      Filesize

      216KB

    • memory/3512-25-0x0000000007170000-0x00000000071A4000-memory.dmp

      Filesize

      208KB

    • memory/3512-4-0x000000007435E000-0x000000007435F000-memory.dmp

      Filesize

      4KB

    • memory/3512-21-0x0000000005D40000-0x0000000005D5E000-memory.dmp

      Filesize

      120KB

    • memory/3512-23-0x0000000006310000-0x0000000006356000-memory.dmp

      Filesize

      280KB

    • memory/3512-22-0x0000000005D90000-0x0000000005DDC000-memory.dmp

      Filesize

      304KB

    • memory/3528-114-0x00000000707F0000-0x0000000070B47000-memory.dmp

      Filesize

      3.3MB

    • memory/3528-111-0x0000000005740000-0x0000000005A97000-memory.dmp

      Filesize

      3.3MB

    • memory/3528-113-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/3612-65-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3612-130-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-215-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-217-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-220-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-227-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-229-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-232-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/3840-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/4164-1-0x00000000048B0000-0x0000000004CB8000-memory.dmp

      Filesize

      4.0MB

    • memory/4164-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4164-53-0x00000000048B0000-0x0000000004CB8000-memory.dmp

      Filesize

      4.0MB

    • memory/4164-54-0x0000000004CC0000-0x00000000055AB000-memory.dmp

      Filesize

      8.9MB

    • memory/4164-55-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/4164-66-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4164-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

      Filesize

      39.0MB

    • memory/4164-2-0x0000000004CC0000-0x00000000055AB000-memory.dmp

      Filesize

      8.9MB

    • memory/4488-164-0x00000000704E0000-0x000000007052C000-memory.dmp

      Filesize

      304KB

    • memory/4488-153-0x0000000005940000-0x0000000005C97000-memory.dmp

      Filesize

      3.3MB

    • memory/4488-163-0x0000000006430000-0x000000000647C000-memory.dmp

      Filesize

      304KB

    • memory/4488-176-0x0000000005CE0000-0x0000000005CF5000-memory.dmp

      Filesize

      84KB

    • memory/4488-165-0x0000000070730000-0x0000000070A87000-memory.dmp

      Filesize

      3.3MB

    • memory/4488-174-0x0000000007160000-0x0000000007204000-memory.dmp

      Filesize

      656KB

    • memory/4488-175-0x0000000007330000-0x0000000007341000-memory.dmp

      Filesize

      68KB

    • memory/4748-143-0x0000000070810000-0x0000000070B67000-memory.dmp

      Filesize

      3.3MB

    • memory/4748-142-0x00000000705C0000-0x000000007060C000-memory.dmp

      Filesize

      304KB

    • memory/4748-140-0x00000000059F0000-0x0000000005D47000-memory.dmp

      Filesize

      3.3MB