glupteba | 48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1

Analysis

max time kernel
1s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20-04-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1.exe
Size

4.2MB
MD5

e423d06991cd715a56ab5df374ad67ee
SHA1

f4040f124b864a42d8cbdaa0274dfac9fad8243f
SHA256

48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1
SHA512

e615bd7032315fcf5e42eb884216ba4130ec29e31189b9cb7da2c6479b24002dbc9df517b32fce0941113bf4b68a825bd87ab04545b62a087d3d57c851c4470e
SSDEEP

98304:jVFRqPMdPA984H0WMAw6acMgLNchhd+W2lPIIo31xn1vrLR/3Lzz:ZFYkS+E0uawLNQ+/9Bo7/j

Score

10^/10

glupteba dropper evasion loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1316-2-0x00000000041A0000-0x0000000004A8B000-memory.dmp	family_glupteba
behavioral2/memory/1316-3-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/1952-53-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/1316-66-0x00000000041A0000-0x0000000004A8B000-memory.dmp	family_glupteba
behavioral2/memory/1316-80-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/1952-164-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-244-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-247-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-259-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-263-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-267-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-271-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-275-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-279-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-283-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-286-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-290-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba
behavioral2/memory/3632-294-0x0000000000400000-0x0000000001DFF000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2812 netsh.exe

pid	process
2812	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3020-255-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3560-260-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3560-268-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4308 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4056 schtasks.exe
388 schtasks.exe

pid	process
4308	sc.exe

pid	process
4056	schtasks.exe
388	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1.exe
"C:\Users\Admin\AppData\Local\Temp\48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1.exe"
1⤵
PID:1316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
PID:1436

C:\Users\Admin\AppData\Local\Temp\48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1.exe
"C:\Users\Admin\AppData\Local\Temp\48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1.exe"
2⤵
PID:1952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:3796

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:2812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:4308

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
PID:3632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:700

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:4056

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:1376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:1452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
PID:3132

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:388

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
PID:3020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:3568

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
PID:4308

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkk5zgjc.x0e.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
dee2cb1e27d76ed77e241ef085a1c52a

SHA1
9bbc7549f26195f5684f1b7f1def02e9d11781d0

SHA256
0350ab2a16a1bbcc0d88c03d50065f927a24be3d8825796829bc993595330ede

SHA512
910cea410c1284f21cb5b8a2e6766cfb62cd983f42352ad1bb2e93d97345cc4d0be2f70b5f1ed25133be178b71ab41925ead08e8f0e20019e7ab9630ef2defd8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
2053b421cb9fabd25e3dcb26cb135882

SHA1
935d951e16844929f1c299358ce375415f0ce693

SHA256
f02dfb11b5cecf1c5dd638d482aaf194d92a86320fe8fbd662348059a4b28ff4

SHA512
4c7b98069e3ecad917bfa82260442610d10c34b0dacd220e98261c7dc34cac5724bda09b3a9ae33e13dfdb39409ffb583fa87c4f58d50c3d0c11d36485781706

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
16fa163cfcd91e3607b1321719570ba5

SHA1
35a194f306000be491742d3eb473be4bea86d888

SHA256
11df9b28756de382c7033830469a09f6380b18c0e45bfd1873155bdb74c93b1b

SHA512
e73912605b51c4d46a1f84d3623238b38d5a323cb0cffa101dd13ce5aac98bfa437f499a4e8f6d825fb22e80f509199b97de62fa76caebe2f511a05a4e85d189

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
e9a7369a1739be7bfc62f065679ca398

SHA1
93b000426e11ea36c2eb9aa89504b0d2d8dc53f7

SHA256
18c88cbb30d6c8f7df76e349f746b7e17bdffa0ec07d244d1675a4be12bf32f5

SHA512
ecba874e4392dbd6f2877b879bb0ecef7bcc6c4bd5333ef0d05e08b6e923bf041d9bde42e90c282912146549308fe842b858b3b3ba2a93e8da2203cb5392b2de

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
c78f966829be86917608887903f94561

SHA1
ef966fbdfc7773af87710f04bfa0d779e291702a

SHA256
f7ebf938f9b64eead4f6c213ae4d96f8179f6e97f20d41c7452566abc3f18858

SHA512
dac94eecd862812f6634098c146fcb1a6ddc6de63c59c0c922150ca4b96eb999fbefbdf2457990002230906d6489095944ed16e5b67dfe76a8964ff048949dfd

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
e423d06991cd715a56ab5df374ad67ee

SHA1
f4040f124b864a42d8cbdaa0274dfac9fad8243f

SHA256
48e5438a1cfaada0f67c6a37f478db9b7b1a9630fc8339322cc3e03a81533ac1

SHA512
e615bd7032315fcf5e42eb884216ba4130ec29e31189b9cb7da2c6479b24002dbc9df517b32fce0941113bf4b68a825bd87ab04545b62a087d3d57c851c4470e

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/696-103-0x0000000071200000-0x0000000071557000-memory.dmp

Filesize
3.3MB

Download
memory/696-101-0x000000007FCB0000-0x000000007FCC0000-memory.dmp

Filesize
64KB

Download
memory/696-97-0x0000000005E80000-0x00000000061D7000-memory.dmp

Filesize
3.3MB

Download
memory/696-98-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/696-112-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/696-115-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/696-96-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/696-113-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/696-102-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download
memory/696-99-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1316-1-0x0000000003DA0000-0x000000000419A000-memory.dmp

Filesize
4.0MB

Download
memory/1316-80-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1316-3-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1316-66-0x00000000041A0000-0x0000000004A8B000-memory.dmp

Filesize
8.9MB

Download
memory/1316-65-0x0000000003DA0000-0x000000000419A000-memory.dmp

Filesize
4.0MB

Download
memory/1316-2-0x00000000041A0000-0x0000000004A8B000-memory.dmp

Filesize
8.9MB

Download
memory/1436-22-0x0000000005B40000-0x0000000005B8C000-memory.dmp

Filesize
304KB

Download
memory/1436-37-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download
memory/1436-44-0x0000000007160000-0x000000000716E000-memory.dmp

Filesize
56KB

Download
memory/1436-45-0x0000000007170000-0x0000000007185000-memory.dmp

Filesize
84KB

Download
memory/1436-46-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/1436-47-0x00000000071E0000-0x00000000071E8000-memory.dmp

Filesize
32KB

Download
memory/1436-50-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/1436-4-0x0000000002630000-0x0000000002666000-memory.dmp

Filesize
216KB

Download
memory/1436-5-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/1436-42-0x0000000007200000-0x0000000007296000-memory.dmp

Filesize
600KB

Download
memory/1436-41-0x00000000070F0000-0x00000000070FA000-memory.dmp

Filesize
40KB

Download
memory/1436-39-0x0000000007700000-0x0000000007D7A000-memory.dmp

Filesize
6.5MB

Download
memory/1436-40-0x00000000070B0000-0x00000000070CA000-memory.dmp

Filesize
104KB

Download
memory/1436-24-0x000000007F5B0000-0x000000007F5C0000-memory.dmp

Filesize
64KB

Download
memory/1436-36-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Filesize
120KB

Download
memory/1436-6-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download
memory/1436-38-0x0000000006F90000-0x0000000007034000-memory.dmp

Filesize
656KB

Download
memory/1436-43-0x0000000007120000-0x0000000007131000-memory.dmp

Filesize
68KB

Download
memory/1436-26-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download
memory/1436-27-0x0000000071180000-0x00000000714D7000-memory.dmp

Filesize
3.3MB

Download
memory/1436-25-0x0000000006F30000-0x0000000006F64000-memory.dmp

Filesize
208KB

Download
memory/1436-8-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download
memory/1436-23-0x00000000060A0000-0x00000000060E6000-memory.dmp

Filesize
280KB

Download
memory/1436-21-0x0000000005B00000-0x0000000005B1E000-memory.dmp

Filesize
120KB

Download
memory/1436-20-0x00000000055E0000-0x0000000005937000-memory.dmp

Filesize
3.3MB

Download
memory/1436-11-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/1436-10-0x0000000005320000-0x0000000005386000-memory.dmp

Filesize
408KB

Download
memory/1436-9-0x0000000004C40000-0x0000000004C62000-memory.dmp

Filesize
136KB

Download
memory/1436-7-0x0000000004CF0000-0x000000000531A000-memory.dmp

Filesize
6.2MB

Download
memory/1952-116-0x0000000003C80000-0x000000000407F000-memory.dmp

Filesize
4.0MB

Download
memory/1952-164-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1952-53-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/1952-52-0x0000000003C80000-0x000000000407F000-memory.dmp

Filesize
4.0MB

Download
memory/2424-79-0x0000000007150000-0x00000000071F4000-memory.dmp

Filesize
656KB

Download
memory/2424-70-0x0000000071130000-0x0000000071487000-memory.dmp

Filesize
3.3MB

Download
memory/2424-82-0x00000000074E0000-0x00000000074F5000-memory.dmp

Filesize
84KB

Download
memory/2424-63-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2424-85-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/2424-81-0x0000000007490000-0x00000000074A1000-memory.dmp

Filesize
68KB

Download
memory/2424-67-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/2424-68-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

Filesize
64KB

Download
memory/2424-62-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2424-69-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download
memory/2424-64-0x0000000005B40000-0x0000000005E97000-memory.dmp

Filesize
3.3MB

Download
memory/3020-255-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3560-260-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3560-268-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3632-267-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-283-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-247-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-299-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-294-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-259-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-290-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-263-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-286-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-244-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-271-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-275-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3632-279-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/4308-125-0x0000000074D40000-0x00000000754F1000-memory.dmp

Filesize
7.7MB

Download
memory/4308-128-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4308-127-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4308-126-0x0000000006200000-0x0000000006557000-memory.dmp

Filesize
3.3MB

Download
memory/4308-130-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download