Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 09:53

General

  • Target

    4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe

  • Size

    4.1MB

  • MD5

    4f190ad743b62026f93246a0fd077bc7

  • SHA1

    75df2c920194dc463f31d24b6b7604661488028a

  • SHA256

    4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba

  • SHA512

    db6be7250a2732c54b1b35138f72c86ea47b1aff2cefb865c11fad1f88370aa54163410edc27cd1f8d78decf181f325c43f23d2ab8fb15642e65a8689f141620

  • SSDEEP

    98304:VH49zrfgobu9aDMWAg4dPDb/NQHvakIF/A8L3rqLZk5t2qZ3qL2LAZ5a:8r7OagDbOPW/F2k5tRZaLrY

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe
    "C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1052
    • C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe
      "C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3968
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4068
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3976
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5012
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1716
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1908
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3396
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4304
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2392
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4384
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1680
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:5100
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wgjs2ka.pzl.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      3b5e97b5939a8058ffbe262df8561f94

      SHA1

      cd878a682679f080ebd568d651f4bcc104a5a8f9

      SHA256

      039c6349ae7df91bb51af39682adb0ff469236566771c3df95f4af209fb88bf6

      SHA512

      7d98c680de15454b141ccbbe3fd2c64e7053ec6c7fbd2088023ad753e35a56b07244de814a577f448197e7d6a7fabc36318a4f5896f248059ac3adc96410bb1c

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      4ca29141d445211bdf08673ffac1bed1

      SHA1

      1a97f37317d21c37f993417347dbf7eae6ad908a

      SHA256

      268b6c6094fd3e912deb6a5648d1c8bd8a6f908450ac5f55570c06e3d7f8e4ea

      SHA512

      fc0ff4d7213aeb8ed12be38cf58cd388415b2f376a07a86f8ec377cc11e93c424c166722e7435cd16d81ef991aa7d80701cdfc8868f4370dfac2e2e48c3af65d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      9fc7c7edee40ec9407f5eb0226ea7d48

      SHA1

      77e902fb80cd10555bb025f753f8270b3c5ccf5f

      SHA256

      940e75a3e991fbf23d680dbcb6ee4a82882f60051a05b2ce2fbc42551d360dd7

      SHA512

      f6a1898cfa5b9dcf3775c06351711c1bb78368a5b2d8176a19476a3109c50a462039bdd953fc5745110738197c320b8f421fcb2d30d751837fa4a249d8ab96ba

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      fd84ec89600560cb2b2b4c5f17fed36a

      SHA1

      cc56fb04fac4926bd1e8386e46afd70e505b9398

      SHA256

      ebf1de9eff14428a4d373dc1ab886dddbdb984e5602be4ecaadae06f46320a58

      SHA512

      5b4622a7e9082b2811016fd18b9603760f212f7e5451e7dbfb2f973846d32c2e8b5d56fe2fcd55f5c0ad127c347226588178abfb0b2cd763cc4c0eca2a94f07a

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      61ad9ce8962e7f2160dccafbfc8d2e05

      SHA1

      e0166cc16677a1e615ebefa441074817ee43d85e

      SHA256

      a2a44b895bfc45a3fb56c124588a539e7706623acc4e80c1f5d1af75253e5a83

      SHA512

      9d352d5bd5374e188b718b4b21f45061c394db34e91c34f68bb9b31a09d1ed55d1b90b7ddba44f2b0197c4c11b9d1599cf2b5147952bbe3f60b3bc9cd58f6739

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      4f190ad743b62026f93246a0fd077bc7

      SHA1

      75df2c920194dc463f31d24b6b7604661488028a

      SHA256

      4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba

      SHA512

      db6be7250a2732c54b1b35138f72c86ea47b1aff2cefb865c11fad1f88370aa54163410edc27cd1f8d78decf181f325c43f23d2ab8fb15642e65a8689f141620

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/1052-50-0x00000000078E0000-0x00000000078E8000-memory.dmp

      Filesize

      32KB

    • memory/1052-6-0x0000000005270000-0x0000000005898000-memory.dmp

      Filesize

      6.2MB

    • memory/1052-17-0x0000000005BB0000-0x0000000005F04000-memory.dmp

      Filesize

      3.3MB

    • memory/1052-22-0x0000000006180000-0x000000000619E000-memory.dmp

      Filesize

      120KB

    • memory/1052-23-0x0000000006450000-0x000000000649C000-memory.dmp

      Filesize

      304KB

    • memory/1052-24-0x00000000066C0000-0x0000000006704000-memory.dmp

      Filesize

      272KB

    • memory/1052-25-0x00000000074A0000-0x0000000007516000-memory.dmp

      Filesize

      472KB

    • memory/1052-26-0x0000000007BA0000-0x000000000821A000-memory.dmp

      Filesize

      6.5MB

    • memory/1052-27-0x0000000007540000-0x000000000755A000-memory.dmp

      Filesize

      104KB

    • memory/1052-29-0x00000000707B0000-0x00000000707FC000-memory.dmp

      Filesize

      304KB

    • memory/1052-28-0x00000000076F0000-0x0000000007722000-memory.dmp

      Filesize

      200KB

    • memory/1052-31-0x0000000070F10000-0x0000000071264000-memory.dmp

      Filesize

      3.3MB

    • memory/1052-30-0x0000000074910000-0x00000000750C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1052-42-0x0000000007750000-0x00000000077F3000-memory.dmp

      Filesize

      652KB

    • memory/1052-41-0x0000000007730000-0x000000000774E000-memory.dmp

      Filesize

      120KB

    • memory/1052-43-0x0000000074910000-0x00000000750C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1052-44-0x0000000007840000-0x000000000784A000-memory.dmp

      Filesize

      40KB

    • memory/1052-45-0x0000000007900000-0x0000000007996000-memory.dmp

      Filesize

      600KB

    • memory/1052-46-0x0000000007860000-0x0000000007871000-memory.dmp

      Filesize

      68KB

    • memory/1052-47-0x00000000078A0000-0x00000000078AE000-memory.dmp

      Filesize

      56KB

    • memory/1052-48-0x00000000078B0000-0x00000000078C4000-memory.dmp

      Filesize

      80KB

    • memory/1052-49-0x00000000079A0000-0x00000000079BA000-memory.dmp

      Filesize

      104KB

    • memory/1052-4-0x000000007491E000-0x000000007491F000-memory.dmp

      Filesize

      4KB

    • memory/1052-53-0x0000000074910000-0x00000000750C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1052-5-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

      Filesize

      216KB

    • memory/1052-11-0x0000000005B40000-0x0000000005BA6000-memory.dmp

      Filesize

      408KB

    • memory/1052-7-0x0000000074910000-0x00000000750C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1052-8-0x0000000074910000-0x00000000750C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1052-9-0x0000000005900000-0x0000000005922000-memory.dmp

      Filesize

      136KB

    • memory/1052-10-0x0000000005A20000-0x0000000005A86000-memory.dmp

      Filesize

      408KB

    • memory/2248-261-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-245-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-265-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-257-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-269-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-273-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2248-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2588-55-0x0000000002920000-0x0000000002D20000-memory.dmp

      Filesize

      4.0MB

    • memory/2588-197-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/2588-218-0x0000000002920000-0x0000000002D20000-memory.dmp

      Filesize

      4.0MB

    • memory/3208-227-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3208-223-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3396-168-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

      Filesize

      3.3MB

    • memory/3396-182-0x00000000072F0000-0x0000000007393000-memory.dmp

      Filesize

      652KB

    • memory/3396-170-0x00000000060E0000-0x000000000612C000-memory.dmp

      Filesize

      304KB

    • memory/3396-171-0x00000000706D0000-0x000000007071C000-memory.dmp

      Filesize

      304KB

    • memory/3396-172-0x0000000070880000-0x0000000070BD4000-memory.dmp

      Filesize

      3.3MB

    • memory/3396-183-0x00000000074B0000-0x00000000074C1000-memory.dmp

      Filesize

      68KB

    • memory/3396-184-0x0000000005E20000-0x0000000005E34000-memory.dmp

      Filesize

      80KB

    • memory/3976-120-0x0000000070F30000-0x0000000071284000-memory.dmp

      Filesize

      3.3MB

    • memory/3976-119-0x00000000707B0000-0x00000000707FC000-memory.dmp

      Filesize

      304KB

    • memory/4068-90-0x0000000005B30000-0x0000000005E84000-memory.dmp

      Filesize

      3.3MB

    • memory/4068-95-0x00000000707B0000-0x00000000707FC000-memory.dmp

      Filesize

      304KB

    • memory/4068-96-0x0000000070F30000-0x0000000071284000-memory.dmp

      Filesize

      3.3MB

    • memory/4304-199-0x0000000070870000-0x0000000070BC4000-memory.dmp

      Filesize

      3.3MB

    • memory/4304-195-0x0000000005F60000-0x00000000062B4000-memory.dmp

      Filesize

      3.3MB

    • memory/4304-198-0x00000000706D0000-0x000000007071C000-memory.dmp

      Filesize

      304KB

    • memory/4384-78-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

      Filesize

      68KB

    • memory/4384-79-0x0000000007CF0000-0x0000000007D04000-memory.dmp

      Filesize

      80KB

    • memory/4384-65-0x00000000061A0000-0x00000000064F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4384-67-0x0000000070EF0000-0x0000000071244000-memory.dmp

      Filesize

      3.3MB

    • memory/4384-66-0x00000000707B0000-0x00000000707FC000-memory.dmp

      Filesize

      304KB

    • memory/4384-77-0x0000000007990000-0x0000000007A33000-memory.dmp

      Filesize

      652KB

    • memory/4496-107-0x0000000002D80000-0x000000000366B000-memory.dmp

      Filesize

      8.9MB

    • memory/4496-1-0x0000000002980000-0x0000000002D80000-memory.dmp

      Filesize

      4.0MB

    • memory/4496-106-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4496-80-0x0000000002980000-0x0000000002D80000-memory.dmp

      Filesize

      4.0MB

    • memory/4496-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4496-2-0x0000000002D80000-0x000000000366B000-memory.dmp

      Filesize

      8.9MB

    • memory/4584-231-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4584-239-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4584-225-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/5012-145-0x0000000006260000-0x00000000065B4000-memory.dmp

      Filesize

      3.3MB

    • memory/5012-147-0x00000000707B0000-0x00000000707FC000-memory.dmp

      Filesize

      304KB

    • memory/5012-148-0x0000000070930000-0x0000000070C84000-memory.dmp

      Filesize

      3.3MB