Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/04/2024, 22:43

General

  • Target

    6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a.exe

  • Size

    4.2MB

  • MD5

    d555a8931b9e996eef75ee0bf5185a74

  • SHA1

    85bbdc0f336f3d2ca8de2559a6a7d4fd454f9b24

  • SHA256

    6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a

  • SHA512

    1bfcf9be143d75574e0393b0489c3b1f7c53bcb27c4df9c1a52715394ef2695b276cf1f75d60d99159ddae9556568658c2521f5a9e620ee432eb246f99d7a9d5

  • SSDEEP

    98304:f/40EOOAEftLoGWLNDgTXMgGOTrFzBqlMJaGItfG9:XdVQtLoTZDg5GO9BqlcV

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 20 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a.exe
    "C:\Users\Admin\AppData\Local\Temp\6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3152
    • C:\Users\Admin\AppData\Local\Temp\6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a.exe
      "C:\Users\Admin\AppData\Local\Temp\6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3700
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3516
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4584
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2900
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1984
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1120
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4368
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1040
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1528
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2328
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3844
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:280
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:816
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3412
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:1968
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:2360

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uk5dpjxq.get.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d0c46cad6c0778401e21910bd6b56b70

            SHA1

            7be418951ea96326aca445b8dfe449b2bfa0dca6

            SHA256

            9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

            SHA512

            057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            3a4f352f075bab8e8a5e75ed5f4997f7

            SHA1

            88dcccb57ce20b033280c2af45218be6175916db

            SHA256

            2b3701096156e2f3e8f342450b80f6c368f7560b7b562819ae22ac3c7273066a

            SHA512

            8b8c5d4183a871258b2e83bf7dc58cf138fa2d83cdd0d2c7bb5f6242674e0eba9c87f226cfcd62e6bb5cb02e207b966e694a88f905f7b2f999ea3e4233a09a7c

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            ee923283245d58bad6f21d1c68c4929d

            SHA1

            f3e179d5e2fefaeae65f6d042eacec9c5ef57040

            SHA256

            5bcccd6e8ea15fc5042ffc164756e38505512707134a51ff4f549e77c9627e51

            SHA512

            4977a7b038ccd4b160aebd781c3c6f30d2e39baf0adbbd8c48cc51b6f54a2b30e73c2f355ededba6bc4bd4ee42508c9fb7bf338eea4b52f7c0b335aefaa0c8d2

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            0d2c6c24b0204803c742d1cc7d7604b6

            SHA1

            71526a2bf3c3892232b10ee9f4507818c4b5a8a4

            SHA256

            87d6d4047cd2d93e2a1f7817e6eac5e3057fdedd2b2720dc4d1181048670015d

            SHA512

            4a6db882c8084dbe86bc7d7a6f0040ef265700a7c87bbe56d5db92cefaa9780473e589927b9d935c2a83082e2647503a1dd69de721a2ae5d78940d885016a37b

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            69b2bc66cb5c6287f8c9dda38f40f814

            SHA1

            45a77849da20a2a87a9459d4aa6296d8dbb49f22

            SHA256

            cadc4252bc11888923780451378cb3f228ca46824dea6d22df166e1a311b9444

            SHA512

            11ada2acb5fa730ff0b2bdff314dc37f6a289b44f1cd84b9fe69c49b2d9ac1ae3fcccfccce7b27f0768eb05d222a3ca41e1b145739d6bb75b04fd0ff4d2073f3

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            9cd414ca6af9fa4af14969797e969537

            SHA1

            132dc7b8a100f6616ca96b8e4732ee6642750181

            SHA256

            515991a060e7a6012509bb0b9e367b2cf732ba980342e3bc2ee39353f7e72651

            SHA512

            4ea96cee20e6d096a3e04d36d9e418cd102eff8012682ae3d60b2f7b2379e738bf07b9c003e1f08de36af86f17f3d58923bfe2cde38b191c9b7197930cb0276f

          • C:\Windows\rss\csrss.exe

            Filesize

            4.2MB

            MD5

            d555a8931b9e996eef75ee0bf5185a74

            SHA1

            85bbdc0f336f3d2ca8de2559a6a7d4fd454f9b24

            SHA256

            6864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a

            SHA512

            1bfcf9be143d75574e0393b0489c3b1f7c53bcb27c4df9c1a52715394ef2695b276cf1f75d60d99159ddae9556568658c2521f5a9e620ee432eb246f99d7a9d5

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/816-251-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/1932-256-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-243-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-254-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-260-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-252-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-262-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-264-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-258-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-266-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-268-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-270-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-272-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1932-145-0x0000000004000000-0x0000000004400000-memory.dmp

            Filesize

            4.0MB

          • memory/1932-274-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/1984-124-0x0000000005430000-0x0000000005440000-memory.dmp

            Filesize

            64KB

          • memory/1984-128-0x0000000070550000-0x00000000708A7000-memory.dmp

            Filesize

            3.3MB

          • memory/1984-127-0x0000000070300000-0x000000007034C000-memory.dmp

            Filesize

            304KB

          • memory/1984-138-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/1984-114-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/1984-126-0x000000007FD80000-0x000000007FD90000-memory.dmp

            Filesize

            64KB

          • memory/2360-257-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/2360-253-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/2900-113-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/2900-100-0x000000007F930000-0x000000007F940000-memory.dmp

            Filesize

            64KB

          • memory/2900-101-0x0000000070300000-0x000000007034C000-memory.dmp

            Filesize

            304KB

          • memory/2900-102-0x0000000070480000-0x00000000707D7000-memory.dmp

            Filesize

            3.3MB

          • memory/2900-98-0x00000000055C0000-0x0000000005917000-memory.dmp

            Filesize

            3.3MB

          • memory/2900-89-0x0000000002570000-0x0000000002580000-memory.dmp

            Filesize

            64KB

          • memory/2900-87-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/2900-88-0x0000000002570000-0x0000000002580000-memory.dmp

            Filesize

            64KB

          • memory/3152-39-0x0000000007D90000-0x000000000840A000-memory.dmp

            Filesize

            6.5MB

          • memory/3152-23-0x00000000065A0000-0x00000000065E6000-memory.dmp

            Filesize

            280KB

          • memory/3152-5-0x0000000073F80000-0x0000000074731000-memory.dmp

            Filesize

            7.7MB

          • memory/3152-4-0x0000000002D10000-0x0000000002D46000-memory.dmp

            Filesize

            216KB

          • memory/3152-6-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/3152-7-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/3152-8-0x00000000054F0000-0x0000000005B1A000-memory.dmp

            Filesize

            6.2MB

          • memory/3152-9-0x00000000052D0000-0x00000000052F2000-memory.dmp

            Filesize

            136KB

          • memory/3152-10-0x0000000005370000-0x00000000053D6000-memory.dmp

            Filesize

            408KB

          • memory/3152-11-0x0000000005450000-0x00000000054B6000-memory.dmp

            Filesize

            408KB

          • memory/3152-20-0x0000000005CA0000-0x0000000005FF7000-memory.dmp

            Filesize

            3.3MB

          • memory/3152-21-0x0000000006180000-0x000000000619E000-memory.dmp

            Filesize

            120KB

          • memory/3152-22-0x00000000061D0000-0x000000000621C000-memory.dmp

            Filesize

            304KB

          • memory/3152-25-0x00000000075C0000-0x00000000075F4000-memory.dmp

            Filesize

            208KB

          • memory/3152-24-0x000000007EFD0000-0x000000007EFE0000-memory.dmp

            Filesize

            64KB

          • memory/3152-26-0x00000000701F0000-0x000000007023C000-memory.dmp

            Filesize

            304KB

          • memory/3152-27-0x0000000070380000-0x00000000706D7000-memory.dmp

            Filesize

            3.3MB

          • memory/3152-37-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/3152-50-0x0000000073F80000-0x0000000074731000-memory.dmp

            Filesize

            7.7MB

          • memory/3152-47-0x00000000078F0000-0x00000000078F8000-memory.dmp

            Filesize

            32KB

          • memory/3152-36-0x0000000007600000-0x000000000761E000-memory.dmp

            Filesize

            120KB

          • memory/3152-46-0x0000000007910000-0x000000000792A000-memory.dmp

            Filesize

            104KB

          • memory/3152-45-0x0000000007810000-0x0000000007825000-memory.dmp

            Filesize

            84KB

          • memory/3152-44-0x0000000007800000-0x000000000780E000-memory.dmp

            Filesize

            56KB

          • memory/3152-43-0x00000000077C0000-0x00000000077D1000-memory.dmp

            Filesize

            68KB

          • memory/3152-42-0x0000000007850000-0x00000000078E6000-memory.dmp

            Filesize

            600KB

          • memory/3152-41-0x0000000007790000-0x000000000779A000-memory.dmp

            Filesize

            40KB

          • memory/3152-40-0x0000000007750000-0x000000000776A000-memory.dmp

            Filesize

            104KB

          • memory/3152-38-0x0000000007620000-0x00000000076C4000-memory.dmp

            Filesize

            656KB

          • memory/3700-82-0x0000000007510000-0x0000000007525000-memory.dmp

            Filesize

            84KB

          • memory/3700-81-0x00000000074C0000-0x00000000074D1000-memory.dmp

            Filesize

            68KB

          • memory/3700-69-0x000000007F7D0000-0x000000007F7E0000-memory.dmp

            Filesize

            64KB

          • memory/3700-71-0x0000000070550000-0x00000000708A7000-memory.dmp

            Filesize

            3.3MB

          • memory/3700-80-0x0000000007170000-0x0000000007214000-memory.dmp

            Filesize

            656KB

          • memory/3700-56-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/3700-85-0x0000000074020000-0x00000000747D1000-memory.dmp

            Filesize

            7.7MB

          • memory/3700-68-0x0000000006530000-0x000000000657C000-memory.dmp

            Filesize

            304KB

          • memory/3700-70-0x0000000070300000-0x000000007034C000-memory.dmp

            Filesize

            304KB

          • memory/3700-59-0x00000000059F0000-0x0000000005D47000-memory.dmp

            Filesize

            3.3MB

          • memory/3700-57-0x0000000004D10000-0x0000000004D20000-memory.dmp

            Filesize

            64KB

          • memory/3700-58-0x0000000004D10000-0x0000000004D20000-memory.dmp

            Filesize

            64KB

          • memory/4228-142-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/4228-55-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/4228-54-0x0000000003F40000-0x000000000482B000-memory.dmp

            Filesize

            8.9MB

          • memory/4228-53-0x0000000003A40000-0x0000000003E3A000-memory.dmp

            Filesize

            4.0MB

          • memory/4228-111-0x0000000003A40000-0x0000000003E3A000-memory.dmp

            Filesize

            4.0MB

          • memory/4228-120-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/4600-1-0x0000000003E70000-0x0000000004276000-memory.dmp

            Filesize

            4.0MB

          • memory/4600-51-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/4600-3-0x0000000000400000-0x0000000001E06000-memory.dmp

            Filesize

            26.0MB

          • memory/4600-2-0x0000000004280000-0x0000000004B6B000-memory.dmp

            Filesize

            8.9MB