Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/03/2024, 20:45

General

  • Target

    37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528.exe

  • Size

    4.1MB

  • MD5

    27c9b07f299c3c6158a6836d3e58b516

  • SHA1

    f9b9887c25eaa092e90fc8f21e2084bf614440bf

  • SHA256

    37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528

  • SHA512

    89ae51614efa6eb07bda66deeb79f1aeed7a97482c4db24efd08c55066d3eee70b6a6050575c2604e6a4c7a40c10dd2535bb151eee7f7a8d86debd9ab7dd844e

  • SSDEEP

    98304:hm2jNuLlNLuTQ1uDx+2u+BVHT9Up7DEgaXYPhZtDZoEdUGdadBnV:Qhf512x+2u+Hup74YPVqEd0db

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528.exe
    "C:\Users\Admin\AppData\Local\Temp\37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3484
    • C:\Users\Admin\AppData\Local\Temp\37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528.exe
      "C:\Users\Admin\AppData\Local\Temp\37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:248
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3988
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3536
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2580
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:4636
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2060
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2584
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4592
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:968
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2236
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:2732
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:3172

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cighkwcn.jcr.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      ac4917a885cf6050b1a483e4bc4d2ea5

      SHA1

      b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

      SHA256

      e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

      SHA512

      092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      c4b6aa9022f0917fd680bfb4f47fbdda

      SHA1

      5f764904d78fb79166173c564e834d9e96aefad6

      SHA256

      f3e6937225647c6172d9eb1b36504cc6bffe24dd2b2d4a0abae0b5c0281de0a3

      SHA512

      40e5e138f8f012bde634b8540fb9084f112c504da744075ee76749c6bfb6ad8bb3dc070a9324db619595f4c74e96257e520db3db45936cae46c235f39ef7ae8c

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      7d7b4fd2bffa980972f640bc34125136

      SHA1

      6bba5ecb79e0cb705a38352d0b1ba3ceba4b92e1

      SHA256

      22339e0bb8006808963dd655519506f15795ba232ef40035bf0e23412cd6c810

      SHA512

      81d862243af73b04bf36056673c419ec204d29c9ba826f9ec238ccedf4dc576a7759f0537714cbb43032aa44854bf0a12c56a0adc59288f1cebc67bce0dc0322

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      6f9d5c9fbeca2ae7d6633863ac53e0e6

      SHA1

      61949a31a9c86db6090570e91226572475c01f53

      SHA256

      ab94ca97c45f353559014ed49a15754f6e555d0b58712e27225939fefda2e9a2

      SHA512

      1f0c18e9179acb6416f60c3396bc7d241729c1bf0adb1e89402d8029098040b1ceb8a8f9f3a7be2a8b61e920f2fd2156f4deee350e27868acaa03faf3b9c2ba9

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      ef2b663a97697352041f7bddcf1479c5

      SHA1

      bba18f89d33a940ed588a1a482ca36a59799fab4

      SHA256

      258e8fecf926819cf5872cd9d89caaa6c4bc2edb08dd6b6f84973412405ac9b1

      SHA512

      72077de66dadad12282b67e844e4437575bb0b6c0c2fa7e369c20559aa03d7ded3f382f4277dc12c4f53bd6cf08f23beabd93a3b2d197aa56222e296ab486abe

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      964ccb8d88a91fa34349d028d90068b7

      SHA1

      ff6b66469ed350eb68580a29b1efc25c0c014aab

      SHA256

      849af4fcbd3bb675354a91b921470fd7c306985a478c37a73e014da3a73df7e8

      SHA512

      18c7223622dd0ae24cb7f9d84c7e8ab3726146d8db3e11997b25929295f6dda8153e04d57c1b5922b38ff0d67f8bb6b12ea38f76a9ebfab109bf016c7acc4a12

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      27c9b07f299c3c6158a6836d3e58b516

      SHA1

      f9b9887c25eaa092e90fc8f21e2084bf614440bf

      SHA256

      37a8626384bffd0b2f7fb52c015f306eea492b7b2cf414c3a83b972674710528

      SHA512

      89ae51614efa6eb07bda66deeb79f1aeed7a97482c4db24efd08c55066d3eee70b6a6050575c2604e6a4c7a40c10dd2535bb151eee7f7a8d86debd9ab7dd844e

    • C:\Windows\windefender.exe

      Filesize

      2.0MB

      MD5

      8e67f58837092385dcf01e8a2b4f5783

      SHA1

      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

      SHA256

      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

      SHA512

      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

    • memory/248-67-0x000000007F620000-0x000000007F630000-memory.dmp

      Filesize

      64KB

    • memory/248-78-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/248-56-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/248-55-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/248-68-0x0000000070C90000-0x0000000070CDC000-memory.dmp

      Filesize

      304KB

    • memory/248-66-0x0000000005860000-0x0000000005BB7000-memory.dmp

      Filesize

      3.3MB

    • memory/248-69-0x0000000070EA0000-0x00000000711F7000-memory.dmp

      Filesize

      3.3MB

    • memory/248-81-0x00000000072D0000-0x00000000072E1000-memory.dmp

      Filesize

      68KB

    • memory/248-82-0x0000000007320000-0x0000000007335000-memory.dmp

      Filesize

      84KB

    • memory/248-79-0x0000000006FA0000-0x0000000007044000-memory.dmp

      Filesize

      656KB

    • memory/248-85-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/248-80-0x0000000004A10000-0x0000000004A20000-memory.dmp

      Filesize

      64KB

    • memory/968-251-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/1280-145-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1280-52-0x0000000002CC0000-0x00000000030C8000-memory.dmp

      Filesize

      4.0MB

    • memory/1280-54-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1280-116-0x0000000002CC0000-0x00000000030C8000-memory.dmp

      Filesize

      4.0MB

    • memory/1488-285-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-258-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-276-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-273-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-242-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-279-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-252-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-264-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-282-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-255-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-267-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-261-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-270-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/3172-260-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3172-254-0x0000000000400000-0x00000000008DF000-memory.dmp

      Filesize

      4.9MB

    • memory/3484-38-0x0000000007AD0000-0x000000000814A000-memory.dmp

      Filesize

      6.5MB

    • memory/3484-10-0x00000000051B0000-0x0000000005216000-memory.dmp

      Filesize

      408KB

    • memory/3484-5-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/3484-4-0x0000000002A00000-0x0000000002A36000-memory.dmp

      Filesize

      216KB

    • memory/3484-49-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/3484-46-0x0000000007670000-0x0000000007678000-memory.dmp

      Filesize

      32KB

    • memory/3484-45-0x0000000007650000-0x000000000766A000-memory.dmp

      Filesize

      104KB

    • memory/3484-44-0x0000000007550000-0x0000000007565000-memory.dmp

      Filesize

      84KB

    • memory/3484-6-0x0000000002C00000-0x0000000002C10000-memory.dmp

      Filesize

      64KB

    • memory/3484-7-0x0000000005260000-0x000000000588A000-memory.dmp

      Filesize

      6.2MB

    • memory/3484-8-0x0000000005030000-0x0000000005052000-memory.dmp

      Filesize

      136KB

    • memory/3484-9-0x00000000050D0000-0x0000000005136000-memory.dmp

      Filesize

      408KB

    • memory/3484-43-0x0000000007540000-0x000000000754E000-memory.dmp

      Filesize

      56KB

    • memory/3484-37-0x0000000007370000-0x0000000007414000-memory.dmp

      Filesize

      656KB

    • memory/3484-19-0x00000000059D0000-0x0000000005D27000-memory.dmp

      Filesize

      3.3MB

    • memory/3484-20-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

      Filesize

      120KB

    • memory/3484-21-0x0000000005F30000-0x0000000005F7C000-memory.dmp

      Filesize

      304KB

    • memory/3484-22-0x0000000006490000-0x00000000064D6000-memory.dmp

      Filesize

      280KB

    • memory/3484-23-0x000000007FCA0000-0x000000007FCB0000-memory.dmp

      Filesize

      64KB

    • memory/3484-24-0x0000000007310000-0x0000000007344000-memory.dmp

      Filesize

      208KB

    • memory/3484-42-0x0000000007500000-0x0000000007511000-memory.dmp

      Filesize

      68KB

    • memory/3484-25-0x0000000070C90000-0x0000000070CDC000-memory.dmp

      Filesize

      304KB

    • memory/3484-41-0x0000000007590000-0x0000000007626000-memory.dmp

      Filesize

      600KB

    • memory/3484-26-0x0000000070E10000-0x0000000071167000-memory.dmp

      Filesize

      3.3MB

    • memory/3484-36-0x0000000002C00000-0x0000000002C10000-memory.dmp

      Filesize

      64KB

    • memory/3484-35-0x0000000007350000-0x000000000736E000-memory.dmp

      Filesize

      120KB

    • memory/3484-40-0x00000000074D0000-0x00000000074DA000-memory.dmp

      Filesize

      40KB

    • memory/3484-39-0x0000000007490000-0x00000000074AA000-memory.dmp

      Filesize

      104KB

    • memory/3536-101-0x0000000070C90000-0x0000000070CDC000-memory.dmp

      Filesize

      304KB

    • memory/3536-87-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/3536-88-0x0000000004AF0000-0x0000000004B00000-memory.dmp

      Filesize

      64KB

    • memory/3536-89-0x0000000004AF0000-0x0000000004B00000-memory.dmp

      Filesize

      64KB

    • memory/3536-92-0x0000000005920000-0x0000000005C77000-memory.dmp

      Filesize

      3.3MB

    • memory/3536-103-0x000000007F3E0000-0x000000007F3F0000-memory.dmp

      Filesize

      64KB

    • memory/3536-102-0x0000000070EE0000-0x0000000071237000-memory.dmp

      Filesize

      3.3MB

    • memory/3536-112-0x0000000004AF0000-0x0000000004B00000-memory.dmp

      Filesize

      64KB

    • memory/3536-114-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/4696-57-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/4696-1-0x0000000002D20000-0x000000000311E000-memory.dmp

      Filesize

      4.0MB

    • memory/4696-51-0x0000000002D20000-0x000000000311E000-memory.dmp

      Filesize

      4.0MB

    • memory/4696-53-0x0000000003120000-0x0000000003A0B000-memory.dmp

      Filesize

      8.9MB

    • memory/4696-3-0x0000000000400000-0x0000000000ECD000-memory.dmp

      Filesize

      10.8MB

    • memory/4696-2-0x0000000003120000-0x0000000003A0B000-memory.dmp

      Filesize

      8.9MB

    • memory/4864-115-0x0000000074A20000-0x00000000751D1000-memory.dmp

      Filesize

      7.7MB

    • memory/4864-117-0x00000000029A0000-0x00000000029B0000-memory.dmp

      Filesize

      64KB

    • memory/4864-118-0x00000000029A0000-0x00000000029B0000-memory.dmp

      Filesize

      64KB

    • memory/4864-129-0x000000007FB20000-0x000000007FB30000-memory.dmp

      Filesize

      64KB

    • memory/4864-130-0x0000000070EE0000-0x0000000071237000-memory.dmp

      Filesize

      3.3MB

    • memory/4864-128-0x0000000070C90000-0x0000000070CDC000-memory.dmp

      Filesize

      304KB