Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 07:08

General

  • Target

    e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe

  • Size

    4.1MB

  • MD5

    a91f291a332061823475e8b9be911856

  • SHA1

    9ef1cb5989f72cd90bb05239dea4b71cc4c8318f

  • SHA256

    e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d

  • SHA512

    b552313a8a830590637742dc61aacd65b1f3635dfc3c1d53f1579115e066806c6e2cd5e1ad556d1086394bc339d80095fcdeb91ce826e56b345aff85889e38e0

  • SSDEEP

    98304:g0IUXroYDzElV89sdV2qHm3LaKbYXl7F29tEHWEXgelgSAZWSyDiLx:bIU7SlV8K2X2AhEHFgekc2

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe
    "C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3776
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe
      "C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3660
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5692
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1868
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5520
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4712
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:6136
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5276
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5640
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4548
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:5428
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:448
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4852
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3592
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kix1oldd.lpc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      860860ea49ccab36d3fc57b7dbfdb4d3

      SHA1

      a7ca4360cb72317242822acacd7dc2d160925894

      SHA256

      2a1cb9fb14ca056e7ca7e436c783bb26112b7ebec4f669a3368bbb2a896fdde7

      SHA512

      49d1524823c171bda53891cb367fe48bc58eafc7cd9c3478894457ffbe471cfaea9a4b174b780274e5d0c95f9e5bf19c2016243f9cac00247e50ef76ace0e24f

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      09cc20d7bfb48e25c68c9c4a30acccaa

      SHA1

      dc854c4d924cb0e2d8b3df284183f91d9d103773

      SHA256

      7902011896854ddf2a25272cdcb76a79d5c6f2c4c0183517a4484c2c5f111301

      SHA512

      a1330a697bc3c51ce480cfa22cd653f5ec9ce67e35d15c8235e9194a47a7810d41117452536b3e6dac1679eebfca0829b9a81a5b9edcbfc476c1a7ce943d9be0

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      e9fd434afe4f9a80f6e3720d02122971

      SHA1

      7242985465400d75b9b08ab0ff3198bd77211b01

      SHA256

      de05dcf193536b87703d02dd32066424823044c9821282fbbc89bac9ecfb4af1

      SHA512

      3ea8c974f04896d940236fd0910f16becc52e69d233e6193b925ab1e54820537260b226b48378163333404ecb9051ab95e48061a4a1c47475e05e01be7c08391

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      5e53c2998edd3736a4f685dada224f5a

      SHA1

      bd2c0a128f4f9cfc79f503846db2842953688364

      SHA256

      c361e8342ea391312e2a0a86cfa1a1562bfb82f0d19d14d48470fb6411b579dd

      SHA512

      18c04c0d2028ddaef659b14fedec99419c025d1edfee3733353912093869d7aeae22d25a0c4f34945500ca6912e6ee35565171108d04da4e0eab39e499afdc4f

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      003dfa2974a84bb45e5ba1621015d596

      SHA1

      27e8015624557b8fb796af8f4c3afdc414ba09ce

      SHA256

      5392a69a8b9801b1f378759f32e19f8dee62c9c281ecc976cc01c52c59730f70

      SHA512

      941a3ca3298544160513780330e6d62f5ff6f8d84aaf573d4bed8cf8554d27d56dffd5cd64831faabeb6e2225c63655dea1acefec002718e44b511cbc9be0081

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      a91f291a332061823475e8b9be911856

      SHA1

      9ef1cb5989f72cd90bb05239dea4b71cc4c8318f

      SHA256

      e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d

      SHA512

      b552313a8a830590637742dc61aacd65b1f3635dfc3c1d53f1579115e066806c6e2cd5e1ad556d1086394bc339d80095fcdeb91ce826e56b345aff85889e38e0

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/448-231-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/448-226-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1032-80-0x0000000007210000-0x0000000007221000-memory.dmp

      Filesize

      68KB

    • memory/1032-69-0x0000000070D60000-0x00000000710B4000-memory.dmp

      Filesize

      3.3MB

    • memory/1032-68-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

      Filesize

      304KB

    • memory/1032-67-0x00000000056B0000-0x0000000005A04000-memory.dmp

      Filesize

      3.3MB

    • memory/1032-79-0x0000000006F00000-0x0000000006FA3000-memory.dmp

      Filesize

      652KB

    • memory/1032-84-0x0000000007260000-0x0000000007274000-memory.dmp

      Filesize

      80KB

    • memory/1868-120-0x0000000006290000-0x00000000065E4000-memory.dmp

      Filesize

      3.3MB

    • memory/1868-122-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

      Filesize

      304KB

    • memory/1868-123-0x0000000070D40000-0x0000000071094000-memory.dmp

      Filesize

      3.3MB

    • memory/2000-140-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/2000-82-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/3776-56-0x0000000004800000-0x0000000004C06000-memory.dmp

      Filesize

      4.0MB

    • memory/3776-2-0x0000000004C10000-0x00000000054FB000-memory.dmp

      Filesize

      8.9MB

    • memory/3776-83-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/3776-1-0x0000000004800000-0x0000000004C06000-memory.dmp

      Filesize

      4.0MB

    • memory/3776-57-0x0000000004C10000-0x00000000054FB000-memory.dmp

      Filesize

      8.9MB

    • memory/3776-55-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/3776-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4116-243-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4116-235-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4116-229-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/4156-258-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-225-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-250-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-262-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-234-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-214-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-238-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-270-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-254-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-266-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-242-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4156-246-0x0000000000400000-0x0000000002B0C000-memory.dmp

      Filesize

      39.0MB

    • memory/4980-28-0x0000000007E50000-0x0000000007E82000-memory.dmp

      Filesize

      200KB

    • memory/4980-24-0x0000000006CF0000-0x0000000006D34000-memory.dmp

      Filesize

      272KB

    • memory/4980-53-0x0000000074D20000-0x00000000754D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4980-4-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

      Filesize

      4KB

    • memory/4980-5-0x0000000005310000-0x0000000005346000-memory.dmp

      Filesize

      216KB

    • memory/4980-50-0x0000000008050000-0x0000000008058000-memory.dmp

      Filesize

      32KB

    • memory/4980-49-0x0000000008100000-0x000000000811A000-memory.dmp

      Filesize

      104KB

    • memory/4980-48-0x0000000008010000-0x0000000008024000-memory.dmp

      Filesize

      80KB

    • memory/4980-47-0x0000000008000000-0x000000000800E000-memory.dmp

      Filesize

      56KB

    • memory/4980-46-0x0000000007FC0000-0x0000000007FD1000-memory.dmp

      Filesize

      68KB

    • memory/4980-45-0x0000000008060000-0x00000000080F6000-memory.dmp

      Filesize

      600KB

    • memory/4980-7-0x0000000005AB0000-0x00000000060D8000-memory.dmp

      Filesize

      6.2MB

    • memory/4980-44-0x0000000007FA0000-0x0000000007FAA000-memory.dmp

      Filesize

      40KB

    • memory/4980-6-0x0000000074D20000-0x00000000754D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4980-8-0x0000000074D20000-0x00000000754D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4980-9-0x0000000005A20000-0x0000000005A42000-memory.dmp

      Filesize

      136KB

    • memory/4980-43-0x0000000074D20000-0x00000000754D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4980-11-0x00000000062B0000-0x0000000006316000-memory.dmp

      Filesize

      408KB

    • memory/4980-10-0x0000000006150000-0x00000000061B6000-memory.dmp

      Filesize

      408KB

    • memory/4980-21-0x0000000006320000-0x0000000006674000-memory.dmp

      Filesize

      3.3MB

    • memory/4980-22-0x00000000068D0000-0x00000000068EE000-memory.dmp

      Filesize

      120KB

    • memory/4980-23-0x0000000006920000-0x000000000696C000-memory.dmp

      Filesize

      304KB

    • memory/4980-25-0x0000000007C70000-0x0000000007CE6000-memory.dmp

      Filesize

      472KB

    • memory/4980-26-0x0000000008370000-0x00000000089EA000-memory.dmp

      Filesize

      6.5MB

    • memory/4980-42-0x0000000007EB0000-0x0000000007F53000-memory.dmp

      Filesize

      652KB

    • memory/4980-27-0x0000000007C10000-0x0000000007C2A000-memory.dmp

      Filesize

      104KB

    • memory/4980-31-0x0000000074D20000-0x00000000754D0000-memory.dmp

      Filesize

      7.7MB

    • memory/4980-41-0x0000000007E90000-0x0000000007EAE000-memory.dmp

      Filesize

      120KB

    • memory/4980-29-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

      Filesize

      304KB

    • memory/4980-30-0x0000000071170000-0x00000000714C4000-memory.dmp

      Filesize

      3.3MB

    • memory/5276-177-0x0000000070C60000-0x0000000070FB4000-memory.dmp

      Filesize

      3.3MB

    • memory/5276-173-0x0000000006220000-0x0000000006574000-memory.dmp

      Filesize

      3.3MB

    • memory/5276-175-0x0000000006830000-0x000000000687C000-memory.dmp

      Filesize

      304KB

    • memory/5276-189-0x0000000006090000-0x00000000060A4000-memory.dmp

      Filesize

      80KB

    • memory/5276-176-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

      Filesize

      304KB

    • memory/5276-188-0x0000000007BF0000-0x0000000007C01000-memory.dmp

      Filesize

      68KB

    • memory/5276-187-0x00000000078C0000-0x0000000007963000-memory.dmp

      Filesize

      652KB

    • memory/5520-152-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

      Filesize

      304KB

    • memory/5520-153-0x0000000071360000-0x00000000716B4000-memory.dmp

      Filesize

      3.3MB

    • memory/5520-150-0x0000000006290000-0x00000000065E4000-memory.dmp

      Filesize

      3.3MB

    • memory/5640-200-0x0000000006270000-0x00000000065C4000-memory.dmp

      Filesize

      3.3MB

    • memory/5640-203-0x0000000070F10000-0x0000000071264000-memory.dmp

      Filesize

      3.3MB

    • memory/5640-202-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

      Filesize

      304KB

    • memory/5692-88-0x0000000005690000-0x00000000059E4000-memory.dmp

      Filesize

      3.3MB

    • memory/5692-100-0x0000000071340000-0x0000000071694000-memory.dmp

      Filesize

      3.3MB

    • memory/5692-99-0x0000000070BC0000-0x0000000070C0C000-memory.dmp

      Filesize

      304KB