Analysis

  • max time kernel
    4s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/04/2024, 19:23

General

  • Target

    29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2.exe

  • Size

    4.2MB

  • MD5

    12c28f325f6710cebe89796872aba437

  • SHA1

    992472d2b130f9a0a419b5982e11f62dda05c79c

  • SHA256

    29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2

  • SHA512

    95d68893354c01f4743b4989103c0d0f56949bdc8e7d58a59be4e19850a68a93c7067c6c12d9cd61ad89a250ce51f6217179bf79acb342d4c7c587d28fb41a0e

  • SSDEEP

    98304:Dz8muvG4/7oo98xMphVIqHAQJ7eNfIWzS5gC960Xfu6ti9vBy29j:DzvuvT/7/zVIWAQdeNfIWzX0W6tA42l

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 20 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2.exe
    "C:\Users\Admin\AppData\Local\Temp\29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Users\Admin\AppData\Local\Temp\29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2.exe
      "C:\Users\Admin\AppData\Local\Temp\29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2.exe"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1520
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
          PID:2872
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          3⤵
            PID:4884
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:3892
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
              PID:4604
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:2272
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                3⤵
                  PID:1868
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                      PID:688
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • Creates scheduled task(s)
                      PID:3808
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      4⤵
                        PID:4796
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                          PID:3020
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                            PID:4600
                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                            4⤵
                              PID:3096
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              4⤵
                              • Creates scheduled task(s)
                              PID:1456
                            • C:\Windows\windefender.exe
                              "C:\Windows\windefender.exe"
                              4⤵
                                PID:3340
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  5⤵
                                    PID:4508
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      6⤵
                                      • Launches sc.exe
                                      PID:1120
                          • C:\Windows\windefender.exe
                            C:\Windows\windefender.exe
                            1⤵
                              PID:1812

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vmkedz1l.yqy.ps1

                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                    Filesize

                                    281KB

                                    MD5

                                    d98e33b66343e7c96158444127a117f6

                                    SHA1

                                    bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                    SHA256

                                    5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                    SHA512

                                    705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                    Filesize

                                    2KB

                                    MD5

                                    d0c46cad6c0778401e21910bd6b56b70

                                    SHA1

                                    7be418951ea96326aca445b8dfe449b2bfa0dca6

                                    SHA256

                                    9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                                    SHA512

                                    057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                    Filesize

                                    19KB

                                    MD5

                                    ec42b5c78e8cdf76a145ff640522548b

                                    SHA1

                                    2f5997d20cdcaaa75e0ae4bdd738ae481168a6c5

                                    SHA256

                                    2ed0d5610e74f5820b6296690fcf3ec0df1a5ddb1a8463f1041cc36b1b7a273c

                                    SHA512

                                    710b3c5af8493d189ac6013bfcf27fcc0497125b50d409f208436d428a0f898fb490256b7ad84ada9ca577d2ebc9d7edf6dd935b1f5a3a226459573d1096f7a8

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                    Filesize

                                    19KB

                                    MD5

                                    f89931f572de7f7d918aa55f16ebcba8

                                    SHA1

                                    ed51ba725dcc0bd5b1034bacfc5022e5e591ce6a

                                    SHA256

                                    57b37f39749daeb5f738b7a4ac6b86e074561b04d51fbc4e787c6fae1ce323a4

                                    SHA512

                                    74ac208cc2b4cf02242dca4f5821dd0db790ed2244552519c2d2c926fe3ba4564f26853a77a9757911b9efe7b9d17c198d931a9cb65eae9414689f00e83c4fbb

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                    Filesize

                                    19KB

                                    MD5

                                    f22ccf55ed36e223539d909a2eeee0a5

                                    SHA1

                                    d38796b61f927ba986381ff03df2e1b238125a33

                                    SHA256

                                    cfcc97e5e683c80630a3f74d2c26e649aee2f414f158921ca0350298c78a5b9a

                                    SHA512

                                    a8b16adc704a4e191482b24bc0dcc4c418912c5d227f027ae5625011a66a9b73b2beafb56060c617cc09679cce78a809b99189d496b8ccb96476bf324cec5f2c

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                    Filesize

                                    19KB

                                    MD5

                                    1032e327a0c33321e1ca13e43dba3491

                                    SHA1

                                    3afcd5cd5213332e33b7d02b9ee537b6b5b7bfbc

                                    SHA256

                                    995e0246f313d05f26c0171142d0c5d8bf41dd299ca0ba2496db21d184f3ed66

                                    SHA512

                                    aa0b12f493875e1dccb440955566f7f29fdb0a0ffd2074bede81be90b4139782332f68aef415926ab98510a0224125815d45f65216d00dba2aefcda316609ed2

                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                    Filesize

                                    19KB

                                    MD5

                                    495d2bf1f56e3cbd50b68565c1711d97

                                    SHA1

                                    7ddca8d09b67e862d1aad62f6676b102a0b5cb48

                                    SHA256

                                    e7ee05df3ab63f7f297eaaf54cd35ec01555110c862530bbc64ff067e303c801

                                    SHA512

                                    4e3b86392c4a670248808b79f49faa78b4eac921febadacff570c8768ff0c85140d36655a0616e7537ae680b37eb86b0405926ffef610ea7caef754e437c5a69

                                  • C:\Windows\rss\csrss.exe

                                    Filesize

                                    4.2MB

                                    MD5

                                    12c28f325f6710cebe89796872aba437

                                    SHA1

                                    992472d2b130f9a0a419b5982e11f62dda05c79c

                                    SHA256

                                    29daf807728f297a2521a2af541723a1ace5379af1f13eeb3c8803403783d3a2

                                    SHA512

                                    95d68893354c01f4743b4989103c0d0f56949bdc8e7d58a59be4e19850a68a93c7067c6c12d9cd61ad89a250ce51f6217179bf79acb342d4c7c587d28fb41a0e

                                  • C:\Windows\windefender.exe

                                    Filesize

                                    2.0MB

                                    MD5

                                    8e67f58837092385dcf01e8a2b4f5783

                                    SHA1

                                    012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                    SHA256

                                    166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                    SHA512

                                    40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                  • memory/8-52-0x0000000005220000-0x0000000005B0B000-memory.dmp

                                    Filesize

                                    8.9MB

                                  • memory/8-51-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/8-3-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/8-2-0x0000000005220000-0x0000000005B0B000-memory.dmp

                                    Filesize

                                    8.9MB

                                  • memory/8-1-0x0000000004E10000-0x0000000005217000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/1520-55-0x0000000005220000-0x0000000005B0B000-memory.dmp

                                    Filesize

                                    8.9MB

                                  • memory/1520-149-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1520-113-0x0000000004E10000-0x0000000005215000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/1520-56-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1520-54-0x0000000004E10000-0x0000000005215000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/1812-258-0x0000000000400000-0x00000000008DF000-memory.dmp

                                    Filesize

                                    4.9MB

                                  • memory/1812-262-0x0000000000400000-0x00000000008DF000-memory.dmp

                                    Filesize

                                    4.9MB

                                  • memory/1868-267-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-273-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-257-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-259-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-261-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-248-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-279-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-277-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-263-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-275-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-265-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-269-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/1868-271-0x0000000000400000-0x000000000310E000-memory.dmp

                                    Filesize

                                    45.1MB

                                  • memory/2272-119-0x0000000004870000-0x0000000004880000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2272-118-0x0000000073E50000-0x0000000074601000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2272-129-0x0000000004870000-0x0000000004880000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2272-120-0x0000000005630000-0x0000000005987000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/2652-40-0x00000000079D0000-0x00000000079EA000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/2652-26-0x0000000070020000-0x000000007006C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2652-4-0x0000000002F40000-0x0000000002F76000-memory.dmp

                                    Filesize

                                    216KB

                                  • memory/2652-5-0x0000000073DB0000-0x0000000074561000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2652-6-0x0000000005830000-0x0000000005E5A000-memory.dmp

                                    Filesize

                                    6.2MB

                                  • memory/2652-7-0x0000000003150000-0x0000000003160000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2652-8-0x0000000003150000-0x0000000003160000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2652-9-0x0000000005550000-0x0000000005572000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/2652-10-0x0000000005700000-0x0000000005766000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/2652-11-0x0000000005770000-0x00000000057D6000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/2652-20-0x0000000005EF0000-0x0000000006247000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/2652-21-0x0000000006410000-0x000000000642E000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/2652-22-0x0000000006470000-0x00000000064BC000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2652-23-0x00000000069D0000-0x0000000006A16000-memory.dmp

                                    Filesize

                                    280KB

                                  • memory/2652-25-0x0000000007850000-0x0000000007884000-memory.dmp

                                    Filesize

                                    208KB

                                  • memory/2652-24-0x000000007F590000-0x000000007F5A0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2652-36-0x0000000007890000-0x00000000078AE000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/2652-38-0x0000000003150000-0x0000000003160000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2652-50-0x0000000073DB0000-0x0000000074561000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2652-37-0x00000000078B0000-0x0000000007954000-memory.dmp

                                    Filesize

                                    656KB

                                  • memory/2652-27-0x00000000701A0000-0x00000000704F7000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/2652-39-0x0000000008020000-0x000000000869A000-memory.dmp

                                    Filesize

                                    6.5MB

                                  • memory/2652-41-0x0000000007A10000-0x0000000007A1A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/2652-42-0x0000000007B20000-0x0000000007BB6000-memory.dmp

                                    Filesize

                                    600KB

                                  • memory/2652-43-0x0000000007A30000-0x0000000007A41000-memory.dmp

                                    Filesize

                                    68KB

                                  • memory/2652-47-0x0000000007B00000-0x0000000007B08000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/2652-46-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/2652-45-0x0000000007A90000-0x0000000007AA5000-memory.dmp

                                    Filesize

                                    84KB

                                  • memory/2652-44-0x0000000007A80000-0x0000000007A8E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/2872-71-0x0000000070130000-0x000000007017C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2872-57-0x0000000002C00000-0x0000000002C10000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2872-60-0x0000000073E50000-0x0000000074601000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2872-69-0x0000000006540000-0x000000000658C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/2872-82-0x00000000073E0000-0x0000000007484000-memory.dmp

                                    Filesize

                                    656KB

                                  • memory/2872-81-0x0000000002C00000-0x0000000002C10000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2872-59-0x0000000005E90000-0x00000000061E7000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/2872-72-0x0000000070380000-0x00000000706D7000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/2872-70-0x000000007F670000-0x000000007F680000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2872-84-0x0000000007970000-0x0000000007985000-memory.dmp

                                    Filesize

                                    84KB

                                  • memory/2872-87-0x0000000073E50000-0x0000000074601000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/2872-58-0x0000000002C00000-0x0000000002C10000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2872-83-0x0000000007920000-0x0000000007931000-memory.dmp

                                    Filesize

                                    68KB

                                  • memory/3340-255-0x0000000000400000-0x00000000008DF000-memory.dmp

                                    Filesize

                                    4.9MB

                                  • memory/4604-91-0x00000000052D0000-0x00000000052E0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4604-102-0x000000007F040000-0x000000007F050000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4604-89-0x0000000073E50000-0x0000000074601000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/4604-90-0x00000000052D0000-0x00000000052E0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4604-117-0x0000000073E50000-0x0000000074601000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/4604-92-0x0000000006290000-0x00000000065E7000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/4604-115-0x00000000052D0000-0x00000000052E0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4604-114-0x00000000052D0000-0x00000000052E0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4604-104-0x0000000070340000-0x0000000070697000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/4604-103-0x0000000070130000-0x000000007017C000-memory.dmp

                                    Filesize

                                    304KB