Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 16:54

General

  • Target

    959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b.exe

  • Size

    4.1MB

  • MD5

    5697ae3edaa60fe9831e4d7fcf3b6c7d

  • SHA1

    abbf6ffb25b29785833153beb54111ce79af70a4

  • SHA256

    959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b

  • SHA512

    cca347bf178dd1ad6615dfeaf097426f6c7c35cec577eea668a790732704e066436b72dc036d11cf1d9c02b0d4289f4d09e1cfb1467b72c3edc7ad003c56ffbf

  • SSDEEP

    98304:blDK2ogLLeo95J5ZPcfTDKdk17ZCPQ0/B9CeuvJXiZ9xD4RskEV31KmzN:h7B3j0rWdEQQ059Cfd4xbkE91Kmx

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b.exe
    "C:\Users\Admin\AppData\Local\Temp\959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1168
    • C:\Users\Admin\AppData\Local\Temp\959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b.exe
      "C:\Users\Admin\AppData\Local\Temp\959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3452
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3484
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4596
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3364
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3384
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1636
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2768
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4684
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:232
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4100
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4664
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4340
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:520

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fyyzo2y.eql.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            731daf87f10d3ed23f05ac76f1e733fb

            SHA1

            ea3cf7710dbcd26e635a3a17fd025126351f1881

            SHA256

            ae9de7f378978f98e07fc4a6afb299ef285203d20981e7dd97b7f007389d19f0

            SHA512

            264e63a395957f611c8cd2b4b3964df2bc99e7c7d4eb2f07979bc7cdf12b46ce402a3bc0b19a5a5b6b27be9ffdeead2e810e08292870a137943ce21b253c0913

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            7c493e949c6c1aaa585d22d7f60c80a2

            SHA1

            7f09d0d098a5c8d1e20616efa8d0c0a3155670b2

            SHA256

            90a227247f314a947ea7cb197ce27de387f90c544d4523e19b67c8085a6c69f4

            SHA512

            d00fc5885a4a456d8de86188e779350a82c2b270864db018f12c3b381361962e58024d991f79f6273d0f4ab2a5920f3a725624eca3996bebb002bd627b1aee4a

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            a1e4d09422cde6c38fe3c3e161d63038

            SHA1

            0e05c96a2c7df9eea21db004fe14a8071dfde50a

            SHA256

            2e9e4c7af56c1100e3b7525e0ee86ac69a0b7e9e80f9d2c5625a12a5d5d3920b

            SHA512

            e616e5acfb10a9dfa4882266f9c7fd1398f3486bb3630eef4b006fb0095625df17d3c299c017fc33519fab3f18afe12c8b8195bc53c5cffeebb01d4f7fabdedf

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            040af75574603a51a73765f93422f0a6

            SHA1

            e64b341653ff0af71e9e9e6ecdf4f44f0473a1ca

            SHA256

            1b1144b4a320af50157acb8884f4f41c7fbc3cefa7b8e3ff78a0c673b74cd95a

            SHA512

            c7e10ad81e74b4fb2e1b2132aca42469e6a33bd20c14b2b808a29dbddf66ebf578863a7f68c66095bb3f2ece55ea84b1db0759cba48a30b43377c452c39dc457

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            fc94799ef27c6c98b852ff53763cac86

            SHA1

            4ce70450a8a13d272f2532eb8f5a64f5ba92ca96

            SHA256

            568288b156dd4fd40481d973c169491a961d6a96e9d5fcc46bedc4f236a7e6c5

            SHA512

            ed0319136faf6fd0d21cdf03618ca6e3f7c01075b2ba7d61afa4372db114ef3120d1f3d339bd9f0e019ec6fe5212ec8bfbc04498a65fdb22e6ba495a807d7d9a

          • C:\Windows\rss\csrss.exe

            Filesize

            4.1MB

            MD5

            5697ae3edaa60fe9831e4d7fcf3b6c7d

            SHA1

            abbf6ffb25b29785833153beb54111ce79af70a4

            SHA256

            959d1fa8c77f5248c79471dc047f6e21fe1bbf762105beb76d045d6b4138a81b

            SHA512

            cca347bf178dd1ad6615dfeaf097426f6c7c35cec577eea668a790732704e066436b72dc036d11cf1d9c02b0d4289f4d09e1cfb1467b72c3edc7ad003c56ffbf

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/468-99-0x0000000070C80000-0x0000000070CCC000-memory.dmp

            Filesize

            304KB

          • memory/468-100-0x0000000070E00000-0x0000000071154000-memory.dmp

            Filesize

            3.3MB

          • memory/520-233-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/520-239-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/520-227-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/1168-41-0x0000000007DB0000-0x0000000007DCE000-memory.dmp

            Filesize

            120KB

          • memory/1168-48-0x0000000007F40000-0x0000000007F4E000-memory.dmp

            Filesize

            56KB

          • memory/1168-26-0x0000000008010000-0x000000000868A000-memory.dmp

            Filesize

            6.5MB

          • memory/1168-27-0x00000000079B0000-0x00000000079CA000-memory.dmp

            Filesize

            104KB

          • memory/1168-30-0x0000000070C80000-0x0000000070CCC000-memory.dmp

            Filesize

            304KB

          • memory/1168-29-0x0000000007D70000-0x0000000007DA2000-memory.dmp

            Filesize

            200KB

          • memory/1168-31-0x0000000071400000-0x0000000071754000-memory.dmp

            Filesize

            3.3MB

          • memory/1168-24-0x0000000006D60000-0x0000000006DA4000-memory.dmp

            Filesize

            272KB

          • memory/1168-42-0x0000000007DD0000-0x0000000007E73000-memory.dmp

            Filesize

            652KB

          • memory/1168-23-0x0000000006830000-0x000000000687C000-memory.dmp

            Filesize

            304KB

          • memory/1168-43-0x0000000074DE0000-0x0000000075590000-memory.dmp

            Filesize

            7.7MB

          • memory/1168-44-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

            Filesize

            40KB

          • memory/1168-45-0x0000000074DE0000-0x0000000075590000-memory.dmp

            Filesize

            7.7MB

          • memory/1168-46-0x0000000008690000-0x0000000008726000-memory.dmp

            Filesize

            600KB

          • memory/1168-47-0x0000000007F00000-0x0000000007F11000-memory.dmp

            Filesize

            68KB

          • memory/1168-25-0x0000000007910000-0x0000000007986000-memory.dmp

            Filesize

            472KB

          • memory/1168-49-0x0000000007F50000-0x0000000007F64000-memory.dmp

            Filesize

            80KB

          • memory/1168-50-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

            Filesize

            104KB

          • memory/1168-51-0x0000000007F90000-0x0000000007F98000-memory.dmp

            Filesize

            32KB

          • memory/1168-54-0x0000000074DE0000-0x0000000075590000-memory.dmp

            Filesize

            7.7MB

          • memory/1168-22-0x0000000006800000-0x000000000681E000-memory.dmp

            Filesize

            120KB

          • memory/1168-21-0x00000000061F0000-0x0000000006544000-memory.dmp

            Filesize

            3.3MB

          • memory/1168-11-0x0000000006180000-0x00000000061E6000-memory.dmp

            Filesize

            408KB

          • memory/1168-10-0x0000000006110000-0x0000000006176000-memory.dmp

            Filesize

            408KB

          • memory/1168-9-0x0000000005820000-0x0000000005842000-memory.dmp

            Filesize

            136KB

          • memory/1168-8-0x0000000074DE0000-0x0000000075590000-memory.dmp

            Filesize

            7.7MB

          • memory/1168-7-0x0000000074DE0000-0x0000000075590000-memory.dmp

            Filesize

            7.7MB

          • memory/1168-6-0x0000000005930000-0x0000000005F58000-memory.dmp

            Filesize

            6.2MB

          • memory/1168-5-0x0000000005240000-0x0000000005276000-memory.dmp

            Filesize

            216KB

          • memory/1168-4-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

            Filesize

            4KB

          • memory/2768-188-0x0000000005AC0000-0x0000000005AD4000-memory.dmp

            Filesize

            80KB

          • memory/2768-176-0x0000000070D30000-0x0000000071084000-memory.dmp

            Filesize

            3.3MB

          • memory/2768-172-0x0000000005BC0000-0x0000000005F14000-memory.dmp

            Filesize

            3.3MB

          • memory/2768-174-0x00000000062A0000-0x00000000062EC000-memory.dmp

            Filesize

            304KB

          • memory/2768-187-0x00000000077B0000-0x00000000077C1000-memory.dmp

            Filesize

            68KB

          • memory/2768-175-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

            Filesize

            304KB

          • memory/2768-186-0x00000000074A0000-0x0000000007543000-memory.dmp

            Filesize

            652KB

          • memory/3364-150-0x0000000070C80000-0x0000000070CCC000-memory.dmp

            Filesize

            304KB

          • memory/3364-151-0x0000000071400000-0x0000000071754000-memory.dmp

            Filesize

            3.3MB

          • memory/3452-68-0x00000000061B0000-0x0000000006504000-memory.dmp

            Filesize

            3.3MB

          • memory/3452-70-0x0000000070E00000-0x0000000071154000-memory.dmp

            Filesize

            3.3MB

          • memory/3452-81-0x0000000007910000-0x00000000079B3000-memory.dmp

            Filesize

            652KB

          • memory/3452-69-0x0000000070C80000-0x0000000070CCC000-memory.dmp

            Filesize

            304KB

          • memory/3452-84-0x0000000007C70000-0x0000000007C84000-memory.dmp

            Filesize

            80KB

          • memory/3452-83-0x0000000007C20000-0x0000000007C31000-memory.dmp

            Filesize

            68KB

          • memory/3808-244-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-161-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-242-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-214-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-247-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-250-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-254-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-238-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-235-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-232-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3808-230-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3824-1-0x0000000003240000-0x0000000003646000-memory.dmp

            Filesize

            4.0MB

          • memory/3824-58-0x0000000004F00000-0x00000000057EB000-memory.dmp

            Filesize

            8.9MB

          • memory/3824-56-0x0000000003240000-0x0000000003646000-memory.dmp

            Filesize

            4.0MB

          • memory/3824-82-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/3824-28-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3824-57-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/3824-2-0x0000000004F00000-0x00000000057EB000-memory.dmp

            Filesize

            8.9MB

          • memory/3824-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/4256-229-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4256-224-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4564-136-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/4564-80-0x0000000000400000-0x0000000002ED6000-memory.dmp

            Filesize

            42.8MB

          • memory/4596-121-0x0000000070C80000-0x0000000070CCC000-memory.dmp

            Filesize

            304KB

          • memory/4596-122-0x0000000071400000-0x0000000071754000-memory.dmp

            Filesize

            3.3MB

          • memory/4684-202-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

            Filesize

            304KB

          • memory/4684-203-0x0000000070D20000-0x0000000071074000-memory.dmp

            Filesize

            3.3MB

          • memory/4684-199-0x00000000059E0000-0x0000000005D34000-memory.dmp

            Filesize

            3.3MB