Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 10:03

General

  • Target

    d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe

  • Size

    4.2MB

  • MD5

    d9c74a3f56c783c73c35cc38c59c1b10

  • SHA1

    67ab4e4f4d6187b375274201f0cb0aa4c4585744

  • SHA256

    a42837e4007f5c67d2f0476ce85d56c9356c90d8e7fd24b874f51b0d8073c90b

  • SHA512

    57df6fae1c6313838555ee1d465c018cf637b72cf59e75eaf8da85860eac6150645c4c235b31eeded78bf6f2cf871924fcb0cc649ffe820f8d76454db0cd94f6

  • SSDEEP

    98304:ir5fFSzbkAtkKd7Zh8Uus6jHe96GrdYXKcZvTJMa5/E4Z:0FukAtpd7Zh8rpj+UGeDVtMajZ

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3872
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4256
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4060
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3772
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4296
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3872
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:964
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4252
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:976
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3940
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:3084
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1500
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4296
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:4952
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4576
      • C:\Windows\windefender.exe
        C:\Windows\windefender.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:468

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtwmz514.2hj.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

        Filesize

        281KB

        MD5

        d98e33b66343e7c96158444127a117f6

        SHA1

        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

        SHA256

        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

        SHA512

        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        3d086a433708053f9bf9523e1d87a4e8

        SHA1

        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

        SHA256

        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

        SHA512

        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        1d41f4ca6589edd944a1731358fb5342

        SHA1

        3d9c56211cdb7e6701a68c49c9f29f7362b9454a

        SHA256

        52eafa8c3f579fe2f261cd346d9e72aa79830271d107823a8c88d8df0cb7a5c4

        SHA512

        18c520267d84833394f7cc46be38e49e8163539d2bb014c7dee85605a9ab988b2d06a5dc9bfbac6a2cf462a0c5a3728c932b2046e87f042f730abe5c79cb4439

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        186eed2cb7fa31f2de6ec399af0630f6

        SHA1

        dc0404fa2949202f4fd92328bf34df96223bcfa4

        SHA256

        7f03ee8d14bf0c63c7ccf44d8bb4ba9096d311fe24542640a45e98b17f8e5768

        SHA512

        7350d20ddc422ce3af57848dd3785031880d36f946959bb7399c87bc6aad474469a66b2bd06c3f394fff97b05b68ad298a0b6736b661f5c5de64e576c7801986

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        f493c5c5fd1e25cdf9319b2bae816502

        SHA1

        9bb40262ffa714a916504797e0b6ff0a2c64d4e7

        SHA256

        3e9634485eb519a44b6e6f43e4f4f60356cfaa1f773cc943ecdae0535ec414ae

        SHA512

        6ce20f261d94ee36cd6b49017080883499aa96ae592787ceb5edd061c7f7a56a0d029af8c94acb443e55d7dab656b854209d4da140b27c7734479cf09d7cffd9

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        a15333108b7212fa14e502d3ac86a028

        SHA1

        0be98e9175c708ff58253dfe122e4b0f302051b5

        SHA256

        abdd8cbfcc85ad876b9f68c6d39dc7528aeaf8ebc1c2bf4a99ab8389970b85ca

        SHA512

        4c30e43b102f59310c7a101c7a92bc0e8cf9ff8747c6b2b32c18371000eb972b74bf17f91b9c482e0262380922852e0fc0472693143dc7af39c5846b69e952da

      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

        Filesize

        19KB

        MD5

        a282d42918bd65ee4f4fdc6529b6939d

        SHA1

        d56bd3a8019eea08844f6d53d474a38371e556be

        SHA256

        0c671afb934e1e0a31146a460404f8b1c3bc634155d296c48de2d458f0401893

        SHA512

        ee3659d3691761cbdd105e3d318e7db483cddbbd15ab14f69789b81dc348c72c4be9da7f240338fe4ed7ffa6c26238c410dd0b315404962716208cc14deee925

      • C:\Windows\rss\csrss.exe

        Filesize

        4.2MB

        MD5

        d9c74a3f56c783c73c35cc38c59c1b10

        SHA1

        67ab4e4f4d6187b375274201f0cb0aa4c4585744

        SHA256

        a42837e4007f5c67d2f0476ce85d56c9356c90d8e7fd24b874f51b0d8073c90b

        SHA512

        57df6fae1c6313838555ee1d465c018cf637b72cf59e75eaf8da85860eac6150645c4c235b31eeded78bf6f2cf871924fcb0cc649ffe820f8d76454db0cd94f6

      • C:\Windows\windefender.exe

        Filesize

        2.0MB

        MD5

        8e67f58837092385dcf01e8a2b4f5783

        SHA1

        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

        SHA256

        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

        SHA512

        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

      • memory/468-237-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/468-243-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/976-206-0x00000000060E0000-0x0000000006434000-memory.dmp

        Filesize

        3.3MB

      • memory/976-208-0x0000000070600000-0x000000007064C000-memory.dmp

        Filesize

        304KB

      • memory/976-209-0x0000000070A00000-0x0000000070D54000-memory.dmp

        Filesize

        3.3MB

      • memory/1088-35-0x0000000007760000-0x0000000007792000-memory.dmp

        Filesize

        200KB

      • memory/1088-52-0x0000000007910000-0x00000000079A6000-memory.dmp

        Filesize

        600KB

      • memory/1088-26-0x00000000066C0000-0x0000000006704000-memory.dmp

        Filesize

        272KB

      • memory/1088-23-0x0000000006230000-0x000000000627C000-memory.dmp

        Filesize

        304KB

      • memory/1088-22-0x0000000006140000-0x000000000615E000-memory.dmp

        Filesize

        120KB

      • memory/1088-29-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1088-30-0x00000000074D0000-0x0000000007546000-memory.dmp

        Filesize

        472KB

      • memory/1088-31-0x0000000007BE0000-0x000000000825A000-memory.dmp

        Filesize

        6.5MB

      • memory/1088-32-0x0000000007590000-0x00000000075AA000-memory.dmp

        Filesize

        104KB

      • memory/1088-17-0x0000000005B60000-0x0000000005EB4000-memory.dmp

        Filesize

        3.3MB

      • memory/1088-34-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1088-5-0x000000007484E000-0x000000007484F000-memory.dmp

        Filesize

        4KB

      • memory/1088-36-0x00000000706E0000-0x000000007072C000-memory.dmp

        Filesize

        304KB

      • memory/1088-37-0x0000000070DE0000-0x0000000071134000-memory.dmp

        Filesize

        3.3MB

      • memory/1088-47-0x0000000007470000-0x000000000748E000-memory.dmp

        Filesize

        120KB

      • memory/1088-48-0x00000000077A0000-0x0000000007843000-memory.dmp

        Filesize

        652KB

      • memory/1088-49-0x0000000007670000-0x000000000767A000-memory.dmp

        Filesize

        40KB

      • memory/1088-50-0x000000007484E000-0x000000007484F000-memory.dmp

        Filesize

        4KB

      • memory/1088-51-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1088-6-0x0000000002810000-0x0000000002846000-memory.dmp

        Filesize

        216KB

      • memory/1088-53-0x00000000078B0000-0x00000000078C1000-memory.dmp

        Filesize

        68KB

      • memory/1088-11-0x0000000005AB0000-0x0000000005B16000-memory.dmp

        Filesize

        408KB

      • memory/1088-55-0x00000000078E0000-0x00000000078EE000-memory.dmp

        Filesize

        56KB

      • memory/1088-56-0x00000000078F0000-0x0000000007904000-memory.dmp

        Filesize

        80KB

      • memory/1088-57-0x00000000079D0000-0x00000000079EA000-memory.dmp

        Filesize

        104KB

      • memory/1088-58-0x00000000079C0000-0x00000000079C8000-memory.dmp

        Filesize

        32KB

      • memory/1088-59-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1088-62-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1088-10-0x0000000005A40000-0x0000000005AA6000-memory.dmp

        Filesize

        408KB

      • memory/1088-9-0x0000000005140000-0x0000000005162000-memory.dmp

        Filesize

        136KB

      • memory/1088-8-0x0000000005310000-0x0000000005938000-memory.dmp

        Filesize

        6.2MB

      • memory/1088-7-0x0000000074840000-0x0000000074FF0000-memory.dmp

        Filesize

        7.7MB

      • memory/1500-231-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/1500-234-0x0000000000400000-0x00000000008DF000-memory.dmp

        Filesize

        4.9MB

      • memory/3772-128-0x0000000070860000-0x0000000070BB4000-memory.dmp

        Filesize

        3.3MB

      • memory/3772-127-0x00000000706E0000-0x000000007072C000-memory.dmp

        Filesize

        304KB

      • memory/3772-125-0x0000000005B80000-0x0000000005ED4000-memory.dmp

        Filesize

        3.3MB

      • memory/3872-75-0x00000000706E0000-0x000000007072C000-memory.dmp

        Filesize

        304KB

      • memory/3872-70-0x0000000005840000-0x0000000005B94000-memory.dmp

        Filesize

        3.3MB

      • memory/3872-88-0x00000000073D0000-0x00000000073E4000-memory.dmp

        Filesize

        80KB

      • memory/3872-87-0x0000000007360000-0x0000000007371000-memory.dmp

        Filesize

        68KB

      • memory/3872-86-0x0000000007060000-0x0000000007103000-memory.dmp

        Filesize

        652KB

      • memory/3872-76-0x0000000070E60000-0x00000000711B4000-memory.dmp

        Filesize

        3.3MB

      • memory/4060-103-0x00000000706E0000-0x000000007072C000-memory.dmp

        Filesize

        304KB

      • memory/4060-104-0x0000000070E60000-0x00000000711B4000-memory.dmp

        Filesize

        3.3MB

      • memory/4252-178-0x0000000005A30000-0x0000000005D84000-memory.dmp

        Filesize

        3.3MB

      • memory/4252-194-0x0000000005830000-0x0000000005844000-memory.dmp

        Filesize

        80KB

      • memory/4252-180-0x0000000006290000-0x00000000062DC000-memory.dmp

        Filesize

        304KB

      • memory/4252-181-0x0000000070600000-0x000000007064C000-memory.dmp

        Filesize

        304KB

      • memory/4252-182-0x0000000070DB0000-0x0000000071104000-memory.dmp

        Filesize

        3.3MB

      • memory/4252-192-0x0000000007320000-0x00000000073C3000-memory.dmp

        Filesize

        652KB

      • memory/4252-193-0x00000000074C0000-0x00000000074D1000-memory.dmp

        Filesize

        68KB

      • memory/4296-157-0x00000000706E0000-0x000000007072C000-memory.dmp

        Filesize

        304KB

      • memory/4296-158-0x0000000070E80000-0x00000000711D4000-memory.dmp

        Filesize

        3.3MB

      • memory/4296-154-0x0000000005F20000-0x0000000006274000-memory.dmp

        Filesize

        3.3MB

      • memory/4640-102-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4640-144-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-236-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-196-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-250-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-247-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-244-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-241-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-238-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4696-226-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4848-1-0x0000000002020000-0x000000000241E000-memory.dmp

        Filesize

        4.0MB

      • memory/4848-25-0x0000000002020000-0x000000000241E000-memory.dmp

        Filesize

        4.0MB

      • memory/4848-4-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4848-24-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4848-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

        Filesize

        9.1MB

      • memory/4848-27-0x0000000003E40000-0x000000000472B000-memory.dmp

        Filesize

        8.9MB

      • memory/4848-28-0x0000000000400000-0x0000000000D1C000-memory.dmp

        Filesize

        9.1MB

      • memory/4848-2-0x0000000003E40000-0x000000000472B000-memory.dmp

        Filesize

        8.9MB

      • memory/4848-33-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4848-54-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB

      • memory/4848-74-0x0000000000400000-0x0000000001DFB000-memory.dmp

        Filesize

        26.0MB