Analysis

  • max time kernel
    15s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 20:03

General

  • Target

    74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf.exe

  • Size

    4.2MB

  • MD5

    907b31cc5de7fe55e8b7e6fae904c487

  • SHA1

    7c5c32781742a8fc8b40611e53cbacd53444dedb

  • SHA256

    74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf

  • SHA512

    09d1a38a501d29447482c29f20ed9fefefb0d7e3bcc475e1f7206fa9cf67269655033dac82db6fd4ac1534e8d0abf9e53db4e887556ae990345fbe4a6e1d488b

  • SSDEEP

    98304:hU4Iq03aI5N3yqqHwBEspKQ2DvCGo03KUue+T5:TIh7By/QBEsp+2hnf5

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 17 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf.exe
    "C:\Users\Admin\AppData\Local\Temp\74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5016
    • C:\Users\Admin\AppData\Local\Temp\74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf.exe
      "C:\Users\Admin\AppData\Local\Temp\74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:372
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2304
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4884
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2272
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1520
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
              PID:3656
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
                PID:3752
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                4⤵
                  PID:1980
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • Creates scheduled task(s)
                  PID:1164
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  4⤵
                    PID:4400
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      5⤵
                        PID:220
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          6⤵
                          • Launches sc.exe
                          PID:1740
              • C:\Windows\windefender.exe
                C:\Windows\windefender.exe
                1⤵
                  PID:4192

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inbarlsd.b3n.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                        Filesize

                        281KB

                        MD5

                        d98e33b66343e7c96158444127a117f6

                        SHA1

                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                        SHA256

                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                        SHA512

                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                        Filesize

                        2KB

                        MD5

                        3d086a433708053f9bf9523e1d87a4e8

                        SHA1

                        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                        SHA256

                        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                        SHA512

                        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                        Filesize

                        19KB

                        MD5

                        4ad2bbe19f605d41786328cf8f2df582

                        SHA1

                        1fb46ce0b5017e31aa07e29e0515411a97ab6cfa

                        SHA256

                        19a2be72564a354b4ac23ff12adb7a50f70ad878f84f543c136ce8cfd7aedb45

                        SHA512

                        6d88f2bdbd074a3b7c73fe596969f002b383d89de1e11a31c31727dd12c7bf1620b35d0a1d1bb078bd7e3a5e5eed1fc5e5c9aa5281124f0891b0cef713fa3d4c

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                        Filesize

                        19KB

                        MD5

                        7c71b2232a9638fc729aebdffe40a7d3

                        SHA1

                        73bc085885121dcda10aca82190e839a3f17e98b

                        SHA256

                        f422d9fc2cd1690504069e9056c0af8c253969fe7c5801f3b3aae03154e9a800

                        SHA512

                        a8c59851b8ace036b656a6604969fab0e42e84229f4c511d18890431a37c3f742870ce29ba5ed244679ce4405c9efc0a57009387588090cb4a2e2ee8e736c5a9

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                        Filesize

                        19KB

                        MD5

                        f39e33b8d9896ff2dd27a43c365690ac

                        SHA1

                        9003b3fd40b456d4e23fe56aef5df9dad02670ae

                        SHA256

                        09c552684375245c4863237af7aaddc5ef624f3529dd12133a7e68799d0eb810

                        SHA512

                        95202567002ef7953be357bb9bc9945c6b3782de3492a7a90508f1b40d2229eb68ab64c1a6cc56b6f172f2661bb650c8815b5fcc2b17dae8038962aa2ec6173c

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                        Filesize

                        19KB

                        MD5

                        072af785810788376f6a2a4d5e6df07c

                        SHA1

                        20afe86449253d0923f574a1ab0be9a77fa685af

                        SHA256

                        bc7e76fbc7086ae3abd2122591075626c384b48eeebe36c2aab032f3c34b6023

                        SHA512

                        b47d1f1d95956a74200396c4c82490172d5cd9b790e7c22926c144d8f0160b65e9626e416fc18668e338e426692bb3dd82a1cdb016f27bde2f0395143294093d

                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                        Filesize

                        19KB

                        MD5

                        7686b1032a60be5ab31dd8ae1c6842cb

                        SHA1

                        48a47b53ceb831676020b5bc68b5954d3e1421bc

                        SHA256

                        5de801cd2b862fd0cd6f47962f3d6783373ae7d4d4645fee2a64510e1dd5eb73

                        SHA512

                        e3290051f4a942100add4f82d9308adbf81df9c7cc8de5a0f6d8f71ff9b0caf4badd2f4734165724a27abacfba6213673c7b80d63e5477cddbfe738bc6d19e44

                      • C:\Windows\rss\csrss.exe

                        Filesize

                        4.2MB

                        MD5

                        907b31cc5de7fe55e8b7e6fae904c487

                        SHA1

                        7c5c32781742a8fc8b40611e53cbacd53444dedb

                        SHA256

                        74f2085f408109b12acdf53a577675a0e31a133b3e6c13b2f116327abaf0f0bf

                        SHA512

                        09d1a38a501d29447482c29f20ed9fefefb0d7e3bcc475e1f7206fa9cf67269655033dac82db6fd4ac1534e8d0abf9e53db4e887556ae990345fbe4a6e1d488b

                      • C:\Windows\windefender.exe

                        Filesize

                        2.0MB

                        MD5

                        8e67f58837092385dcf01e8a2b4f5783

                        SHA1

                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                        SHA256

                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                        SHA512

                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                      • memory/372-95-0x00000000024E0000-0x00000000024F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/372-123-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/372-120-0x00000000024E0000-0x00000000024F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/372-110-0x0000000070EC0000-0x0000000071214000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/372-109-0x0000000070720000-0x000000007076C000-memory.dmp

                        Filesize

                        304KB

                      • memory/372-102-0x00000000054A0000-0x00000000057F4000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/372-96-0x00000000024E0000-0x00000000024F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/372-94-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/1608-260-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-306-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-314-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-270-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-311-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-274-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-278-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-302-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-282-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-298-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-294-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-290-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/1608-286-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/2304-126-0x00000000050F0000-0x0000000005100000-memory.dmp

                        Filesize

                        64KB

                      • memory/2304-125-0x00000000050F0000-0x0000000005100000-memory.dmp

                        Filesize

                        64KB

                      • memory/2304-124-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/2304-136-0x0000000006280000-0x00000000065D4000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/3000-57-0x0000000004E60000-0x0000000005260000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/3000-1-0x0000000004E60000-0x0000000005260000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/3000-3-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/3000-2-0x0000000005260000-0x0000000005B4B000-memory.dmp

                        Filesize

                        8.9MB

                      • memory/3000-72-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/4192-281-0x0000000000400000-0x00000000008DF000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/4192-273-0x0000000000400000-0x00000000008DF000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/4400-268-0x0000000000400000-0x00000000008DF000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/4548-73-0x000000007F270000-0x000000007F280000-memory.dmp

                        Filesize

                        64KB

                      • memory/4548-70-0x0000000004970000-0x0000000004980000-memory.dmp

                        Filesize

                        64KB

                      • memory/4548-85-0x0000000004970000-0x0000000004980000-memory.dmp

                        Filesize

                        64KB

                      • memory/4548-86-0x0000000004970000-0x0000000004980000-memory.dmp

                        Filesize

                        64KB

                      • memory/4548-87-0x00000000070E0000-0x0000000007183000-memory.dmp

                        Filesize

                        652KB

                      • memory/4548-75-0x0000000070ED0000-0x0000000071224000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/4548-88-0x0000000007410000-0x0000000007421000-memory.dmp

                        Filesize

                        68KB

                      • memory/4548-89-0x0000000007460000-0x0000000007474000-memory.dmp

                        Filesize

                        80KB

                      • memory/4548-92-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4548-74-0x0000000070720000-0x000000007076C000-memory.dmp

                        Filesize

                        304KB

                      • memory/4548-71-0x0000000005990000-0x0000000005CE4000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/4548-60-0x0000000004970000-0x0000000004980000-memory.dmp

                        Filesize

                        64KB

                      • memory/4548-59-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4600-58-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/4600-56-0x0000000005180000-0x0000000005A6B000-memory.dmp

                        Filesize

                        8.9MB

                      • memory/4600-55-0x0000000004D70000-0x0000000005173000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4600-190-0x0000000000400000-0x0000000003118000-memory.dmp

                        Filesize

                        45.1MB

                      • memory/4600-121-0x0000000004D70000-0x0000000005173000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/5016-45-0x0000000007C40000-0x0000000007CD6000-memory.dmp

                        Filesize

                        600KB

                      • memory/5016-26-0x0000000007E70000-0x00000000084EA000-memory.dmp

                        Filesize

                        6.5MB

                      • memory/5016-48-0x0000000007BA0000-0x0000000007BB4000-memory.dmp

                        Filesize

                        80KB

                      • memory/5016-47-0x0000000007B80000-0x0000000007B8E000-memory.dmp

                        Filesize

                        56KB

                      • memory/5016-46-0x0000000007B40000-0x0000000007B51000-memory.dmp

                        Filesize

                        68KB

                      • memory/5016-50-0x0000000007BE0000-0x0000000007BE8000-memory.dmp

                        Filesize

                        32KB

                      • memory/5016-44-0x0000000007B30000-0x0000000007B3A000-memory.dmp

                        Filesize

                        40KB

                      • memory/5016-43-0x0000000007A40000-0x0000000007AE3000-memory.dmp

                        Filesize

                        652KB

                      • memory/5016-41-0x0000000007A20000-0x0000000007A3E000-memory.dmp

                        Filesize

                        120KB

                      • memory/5016-53-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/5016-42-0x0000000004E30000-0x0000000004E40000-memory.dmp

                        Filesize

                        64KB

                      • memory/5016-31-0x00000000708C0000-0x0000000070C14000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/5016-30-0x0000000070720000-0x000000007076C000-memory.dmp

                        Filesize

                        304KB

                      • memory/5016-28-0x000000007EF90000-0x000000007EFA0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5016-29-0x00000000079E0000-0x0000000007A12000-memory.dmp

                        Filesize

                        200KB

                      • memory/5016-49-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

                        Filesize

                        104KB

                      • memory/5016-27-0x0000000007820000-0x000000000783A000-memory.dmp

                        Filesize

                        104KB

                      • memory/5016-25-0x0000000007770000-0x00000000077E6000-memory.dmp

                        Filesize

                        472KB

                      • memory/5016-24-0x00000000069C0000-0x0000000006A04000-memory.dmp

                        Filesize

                        272KB

                      • memory/5016-23-0x00000000064A0000-0x00000000064EC000-memory.dmp

                        Filesize

                        304KB

                      • memory/5016-22-0x0000000006450000-0x000000000646E000-memory.dmp

                        Filesize

                        120KB

                      • memory/5016-21-0x0000000005E40000-0x0000000006194000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/5016-11-0x0000000005D10000-0x0000000005D76000-memory.dmp

                        Filesize

                        408KB

                      • memory/5016-10-0x0000000005CA0000-0x0000000005D06000-memory.dmp

                        Filesize

                        408KB

                      • memory/5016-9-0x0000000005480000-0x00000000054A2000-memory.dmp

                        Filesize

                        136KB

                      • memory/5016-7-0x0000000005500000-0x0000000005B28000-memory.dmp

                        Filesize

                        6.2MB

                      • memory/5016-8-0x0000000004E30000-0x0000000004E40000-memory.dmp

                        Filesize

                        64KB

                      • memory/5016-6-0x0000000004E30000-0x0000000004E40000-memory.dmp

                        Filesize

                        64KB

                      • memory/5016-5-0x0000000074880000-0x0000000075030000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/5016-4-0x0000000004E90000-0x0000000004EC6000-memory.dmp

                        Filesize

                        216KB