Analysis

  • max time kernel
    20s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-05-2024 18:10

General

  • Target

    f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe

  • Size

    4.1MB

  • MD5

    c339e6362e442d227eb5672db7dae1ff

  • SHA1

    7f2c2b09a7702a770d176b70e756f1d2519a6a7b

  • SHA256

    f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae

  • SHA512

    e731f2fabb282a9a2b575c66b3fb0d9bab809838f9fb0b36d10d39df39452344ca8fdf21e78feb79b2446183df5aaa2325b5b702f6d2f629fa7aae85678071ef

  • SSDEEP

    98304:QoKALZtLSnhBaG13jSGzI9y04m/Xf7c/d7YDSGfJg5NEka2Q+gE:QC1IraEjIw04m/Xfo4a5yka2Q+gE

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 15 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1464
    • C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe
      "C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"
      2⤵
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2876
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2472
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3120
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2980
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
          PID:1304
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3460
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:760
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /delete /tn ScheduledUpdate /f
            4⤵
              PID:3800
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2948
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4124
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              4⤵
                PID:4464
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • Creates scheduled task(s)
                PID:3856
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                4⤵
                  PID:2256
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    5⤵
                      PID:660
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        6⤵
                        • Launches sc.exe
                        PID:280
            • C:\Windows\windefender.exe
              C:\Windows\windefender.exe
              1⤵
                PID:3596

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjyc3wia.kqd.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                d0c46cad6c0778401e21910bd6b56b70

                SHA1

                7be418951ea96326aca445b8dfe449b2bfa0dca6

                SHA256

                9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                SHA512

                057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                29041a3b52d6ec766057120f0407a68d

                SHA1

                3d0eb9eb6543d25f1ff30e3e73a6dd45bdcf14d5

                SHA256

                eca6c7422f88233c7fa2cbee33cdb4a3ad16ed756776ac6def151f8392479902

                SHA512

                d737c719833aa45a52fa10741ce7bc98fe7dc6da4572db82f8469025ff8201c2daa14a274bc212fe51c76ddd786c96c5593da47755b134a4291bb453fe7a5843

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                88019017738a3a2ea2cdad4a2b8ecd13

                SHA1

                83abbce536c50f3c3997c7f98be470760b759d9f

                SHA256

                26751dc5d45f0ba7f2a8366661d7424f3abea297f0df73138fb82c627dba2b59

                SHA512

                76767448d1303e8873887c887c47e9f2f1473b325bd2d210e437ae8746a6f02df5bc96f0745f546a3aeb19060eb292f46527828155286ea845bbf3b86959a1dd

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                fd78f895855f2d9da21e5cdd35cd4754

                SHA1

                909f7eefa9bf0f483c3f277859c7452165569dd3

                SHA256

                218dcba1359460088add0964c3500d57649c94b7ad85d19228f9f6b59be91227

                SHA512

                cc0c3f18b801ed5bdfa9c005f74b216d343167c04d731d92f5273ce2788f0c518c7bc11464d16137563d868d450b7319e4270a15781ac736ef9febb296d3cb21

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                f1bf29ac8509435c23c35c1555b13887

                SHA1

                5968888e43be2ee97b1c0eb00d823289df93b6fb

                SHA256

                f1d56be7748255191055d7933cadf054379278124db719ace50b9da352c966ff

                SHA512

                008880eb819f5bf2194cff6958ccc4c138c59a1c09d25f23e8188acc5be15b0533e45078e0a214aba7fef32efdec27ac064c722c02d4a5111ed1b8f0a2e22de1

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                19KB

                MD5

                794afa1ef03d8d2aba1e2ed10861ab65

                SHA1

                260dd9e4d45ec7868f80eb226dc1c9e563249810

                SHA256

                5a460f72123964831d4cf15c5d0bbd9bfd4d4c22a596e7b63f07caa9e68ba96d

                SHA512

                e0dced2a52866012a6da83dbf1c693c3604f3fc3d4d784a4955575e6b79d56f234843c825603ecf743fc1e7672b7cbed4abfb9453c48e215b56d5d3dfcf934f4

              • C:\Windows\rss\csrss.exe

                Filesize

                3.6MB

                MD5

                4ee1d74acca14f140778165c2c9dad59

                SHA1

                b577cab5e24dfe11164e5dd8210bb9914672ba47

                SHA256

                b2ccb25f40e23b25db296b0d5a5c4145c7af805d90766ecac2f3dfaace8feecb

                SHA512

                72bd95e2294054955e4c842dad8b499a349ce28c1f776f1bb4d4e9353fef3f2efb258fdb0085901097e7eeec3a57a3f72c41f18b446baebfa2c6a5d7038f511a

              • C:\Windows\rss\csrss.exe

                Filesize

                4.1MB

                MD5

                c339e6362e442d227eb5672db7dae1ff

                SHA1

                7f2c2b09a7702a770d176b70e756f1d2519a6a7b

                SHA256

                f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae

                SHA512

                e731f2fabb282a9a2b575c66b3fb0d9bab809838f9fb0b36d10d39df39452344ca8fdf21e78feb79b2446183df5aaa2325b5b702f6d2f629fa7aae85678071ef

              • C:\Windows\windefender.exe

                Filesize

                1.2MB

                MD5

                a43d1181c5c818d7d78e782ec1828903

                SHA1

                ce87b6b09f2b30c85a2420d7e1471a0c2db55475

                SHA256

                57b26db83b472d3aa74fdc739ae2a2aab69513a334cc9850d2adc81053093cf4

                SHA512

                5985d550e97d5a383a3b121dd3c42ef032f3815afa7ac6ff35c0935fb143c51c5ac0406b0dd854c1936aff98d8da964ba1c390187b81380ee891ac8708cdd6d4

              • C:\Windows\windefender.exe

                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              • memory/1304-213-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-227-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-245-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1304-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/1464-37-0x00000000076E0000-0x0000000007784000-memory.dmp

                Filesize

                656KB

              • memory/1464-11-0x0000000005D10000-0x0000000005D76000-memory.dmp

                Filesize

                408KB

              • memory/1464-24-0x0000000007680000-0x00000000076B4000-memory.dmp

                Filesize

                208KB

              • memory/1464-43-0x0000000007870000-0x0000000007881000-memory.dmp

                Filesize

                68KB

              • memory/1464-44-0x00000000078C0000-0x00000000078CE000-memory.dmp

                Filesize

                56KB

              • memory/1464-46-0x0000000007920000-0x000000000793A000-memory.dmp

                Filesize

                104KB

              • memory/1464-45-0x00000000078D0000-0x00000000078E5000-memory.dmp

                Filesize

                84KB

              • memory/1464-47-0x0000000007940000-0x0000000007948000-memory.dmp

                Filesize

                32KB

              • memory/1464-50-0x0000000074780000-0x0000000074F31000-memory.dmp

                Filesize

                7.7MB

              • memory/1464-4-0x000000007478E000-0x000000007478F000-memory.dmp

                Filesize

                4KB

              • memory/1464-5-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

                Filesize

                216KB

              • memory/1464-7-0x0000000005570000-0x0000000005B9A000-memory.dmp

                Filesize

                6.2MB

              • memory/1464-8-0x0000000074780000-0x0000000074F31000-memory.dmp

                Filesize

                7.7MB

              • memory/1464-6-0x0000000074780000-0x0000000074F31000-memory.dmp

                Filesize

                7.7MB

              • memory/1464-42-0x0000000007960000-0x00000000079F6000-memory.dmp

                Filesize

                600KB

              • memory/1464-20-0x0000000005DA0000-0x00000000060F7000-memory.dmp

                Filesize

                3.3MB

              • memory/1464-10-0x0000000005CA0000-0x0000000005D06000-memory.dmp

                Filesize

                408KB

              • memory/1464-9-0x0000000005390000-0x00000000053B2000-memory.dmp

                Filesize

                136KB

              • memory/1464-21-0x0000000006240000-0x000000000625E000-memory.dmp

                Filesize

                120KB

              • memory/1464-25-0x00000000709F0000-0x0000000070A3C000-memory.dmp

                Filesize

                304KB

              • memory/1464-41-0x0000000007850000-0x000000000785A000-memory.dmp

                Filesize

                40KB

              • memory/1464-39-0x0000000007E50000-0x00000000084CA000-memory.dmp

                Filesize

                6.5MB

              • memory/1464-40-0x0000000007810000-0x000000000782A000-memory.dmp

                Filesize

                104KB

              • memory/1464-26-0x0000000074780000-0x0000000074F31000-memory.dmp

                Filesize

                7.7MB

              • memory/1464-36-0x00000000076C0000-0x00000000076DE000-memory.dmp

                Filesize

                120KB

              • memory/1464-38-0x0000000074780000-0x0000000074F31000-memory.dmp

                Filesize

                7.7MB

              • memory/1464-27-0x0000000070B70000-0x0000000070EC7000-memory.dmp

                Filesize

                3.3MB

              • memory/1464-23-0x00000000067C0000-0x0000000006806000-memory.dmp

                Filesize

                280KB

              • memory/1464-22-0x0000000006290000-0x00000000062DC000-memory.dmp

                Filesize

                304KB

              • memory/1552-53-0x0000000000400000-0x0000000000D1C000-memory.dmp

                Filesize

                9.1MB

              • memory/1552-2-0x0000000004D50000-0x000000000563B000-memory.dmp

                Filesize

                8.9MB

              • memory/1552-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                Filesize

                9.1MB

              • memory/1552-1-0x0000000004950000-0x0000000004D4D000-memory.dmp

                Filesize

                4.0MB

              • memory/1552-54-0x0000000004D50000-0x000000000563B000-memory.dmp

                Filesize

                8.9MB

              • memory/1552-51-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/2180-122-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/2180-198-0x0000000000400000-0x0000000002B0B000-memory.dmp

                Filesize

                39.0MB

              • memory/2256-211-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/2256-215-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/2876-63-0x0000000005FB0000-0x0000000006307000-memory.dmp

                Filesize

                3.3MB

              • memory/2876-64-0x0000000006540000-0x000000000658C000-memory.dmp

                Filesize

                304KB

              • memory/2876-77-0x0000000007A80000-0x0000000007A95000-memory.dmp

                Filesize

                84KB

              • memory/2876-66-0x0000000070C80000-0x0000000070FD7000-memory.dmp

                Filesize

                3.3MB

              • memory/2876-75-0x0000000007700000-0x00000000077A4000-memory.dmp

                Filesize

                656KB

              • memory/2876-65-0x0000000070B00000-0x0000000070B4C000-memory.dmp

                Filesize

                304KB

              • memory/2876-76-0x0000000007A30000-0x0000000007A41000-memory.dmp

                Filesize

                68KB

              • memory/2948-176-0x0000000007220000-0x0000000007231000-memory.dmp

                Filesize

                68KB

              • memory/2948-165-0x0000000070980000-0x00000000709CC000-memory.dmp

                Filesize

                304KB

              • memory/2948-175-0x0000000006F00000-0x0000000006FA4000-memory.dmp

                Filesize

                656KB

              • memory/2948-166-0x0000000070BD0000-0x0000000070F27000-memory.dmp

                Filesize

                3.3MB

              • memory/2948-164-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

                Filesize

                304KB

              • memory/2948-162-0x0000000005710000-0x0000000005A67000-memory.dmp

                Filesize

                3.3MB

              • memory/2948-177-0x0000000005680000-0x0000000005695000-memory.dmp

                Filesize

                84KB

              • memory/2980-110-0x0000000005CC0000-0x0000000006017000-memory.dmp

                Filesize

                3.3MB

              • memory/2980-112-0x0000000070B00000-0x0000000070B4C000-memory.dmp

                Filesize

                304KB

              • memory/2980-113-0x0000000070D50000-0x00000000710A7000-memory.dmp

                Filesize

                3.3MB

              • memory/3120-91-0x0000000070B00000-0x0000000070B4C000-memory.dmp

                Filesize

                304KB

              • memory/3120-89-0x00000000057D0000-0x0000000005B27000-memory.dmp

                Filesize

                3.3MB

              • memory/3120-92-0x0000000071440000-0x0000000071797000-memory.dmp

                Filesize

                3.3MB

              • memory/3460-152-0x0000000005B60000-0x0000000005B75000-memory.dmp

                Filesize

                84KB

              • memory/3460-150-0x00000000070B0000-0x0000000007154000-memory.dmp

                Filesize

                656KB

              • memory/3460-139-0x0000000006330000-0x000000000637C000-memory.dmp

                Filesize

                304KB

              • memory/3460-141-0x0000000070C90000-0x0000000070FE7000-memory.dmp

                Filesize

                3.3MB

              • memory/3460-137-0x00000000057E0000-0x0000000005B37000-memory.dmp

                Filesize

                3.3MB

              • memory/3460-140-0x0000000070A60000-0x0000000070AAC000-memory.dmp

                Filesize

                304KB

              • memory/3460-151-0x0000000007420000-0x0000000007431000-memory.dmp

                Filesize

                68KB

              • memory/3596-216-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/3596-225-0x0000000000400000-0x00000000008DF000-memory.dmp

                Filesize

                4.9MB

              • memory/4124-188-0x0000000070980000-0x00000000709CC000-memory.dmp

                Filesize

                304KB

              • memory/4124-189-0x0000000070BD0000-0x0000000070F27000-memory.dmp

                Filesize

                3.3MB