Analysis

  • max time kernel
    23s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 20:03

General

  • Target

    71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe

  • Size

    4.2MB

  • MD5

    62dc86ed5cec63e5ccb959c407a4a591

  • SHA1

    2070a84ba529d62ee28745bbc5c810bfbb9b721c

  • SHA256

    71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1

  • SHA512

    de79eeef9db2c8ffc50fc843a397f3bd48d61a52287ecc13ab32093a4405bf3c338cb87f4bf71f76c1e7e6e30dca6a4cc683657009558ff6b7ac11295884dc3c

  • SSDEEP

    98304:RU4Iq03aI5N3yqqHwBEspKQ2DvCGo03KUue+TU:DIh7By/QBEsp+2hnfU

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 17 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe
    "C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
    • C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe
      "C:\Users\Admin\AppData\Local\Temp\71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1.exe"
      2⤵
        PID:1520
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          3⤵
            PID:3156
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
              PID:1392
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:3896
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:1428
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                3⤵
                  PID:1076
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  3⤵
                    PID:3944
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                        PID:4484
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        4⤵
                        • Creates scheduled task(s)
                        PID:1444
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        4⤵
                          PID:2348
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                            PID:4656
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            4⤵
                              PID:508
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              4⤵
                                PID:452
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                4⤵
                                • Creates scheduled task(s)
                                PID:448
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                4⤵
                                  PID:4484
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    5⤵
                                      PID:4860
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        6⤵
                                        • Launches sc.exe
                                        PID:2512
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
                              1⤵
                                PID:5044
                              • C:\Windows\windefender.exe
                                C:\Windows\windefender.exe
                                1⤵
                                  PID:3924

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmfkelve.rok.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                        Filesize

                                        281KB

                                        MD5

                                        d98e33b66343e7c96158444127a117f6

                                        SHA1

                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                        SHA256

                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                        SHA512

                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        968cb9309758126772781b83adb8a28f

                                        SHA1

                                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                                        SHA256

                                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                        SHA512

                                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                        Filesize

                                        19KB

                                        MD5

                                        15f41655c09d01cafbc0656c46547fcc

                                        SHA1

                                        652f23511aea564014f5d5448402295146d45f01

                                        SHA256

                                        6564bed4e87a0f5b40d06864fb11617278b75ee10512d3d3615dacc07d65a159

                                        SHA512

                                        a9644b1f3c02d8ab488a1ce689afc14a1683e37b0f07959e430378d773f59cb149194515725e77ca5a75b6466553eceec67690249c2969fc5eed99df1064a0fb

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                        Filesize

                                        19KB

                                        MD5

                                        0b5f1c3ec30c88491994bfbb58b648cc

                                        SHA1

                                        4313810e9013334fc1dc39f8f70b6a3505921e9e

                                        SHA256

                                        d789aefc6393951ba71688f57647c7a58f44a2b7270af7816eb4fd37a2d3e36b

                                        SHA512

                                        cf9c32930a2ce6f74883d8f48631b6df9fdfda8522a90e48555f6a78b2450c7249c2915165f134219acf035a756371284e16255662fece6d77d25d21031edc00

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                        Filesize

                                        19KB

                                        MD5

                                        e7af9a69a040c54c739b2bd747751cfc

                                        SHA1

                                        3e2512d213ab4b191871d918b19089a863902faf

                                        SHA256

                                        070406875a4e50e28decc426150d552886d4ea03ed8c1ddb825be264bdbe8916

                                        SHA512

                                        77d7623d3fc37eca2f735090e24712e0cad8558e9a700988f134c27346964a4c2fc14cc23904b665ea588fe5330e193b2baad52b09b1aa3ec47b499978365da0

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                        Filesize

                                        19KB

                                        MD5

                                        ac98381bc04410674d2478be9264cb9f

                                        SHA1

                                        924dc7b97af3807f050f30b43e3acaeaa28189a8

                                        SHA256

                                        d82796e2532816ba99c5b76ace8e24d0ef5cb9b246fa10e193449fa670da43e9

                                        SHA512

                                        442f85ac792eac3aa5702e62c13890f563e6542689edff4a45bbced84a0dd7680ec37cee62b540686de13e3e0ae82c7594569cff92190a77ceead60167f7ed9f

                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                        Filesize

                                        19KB

                                        MD5

                                        2125bb5ca95db99afb3e66c9610ab8e4

                                        SHA1

                                        0aca4667e020dd363945a971cd4d5d110a85c646

                                        SHA256

                                        fda423aeca8bcf7be286ed87d8ea872903b102bedd83798471ba3901e158ba5e

                                        SHA512

                                        c7239bd924737e058dc14395956e867b564fee8314edddd1c8bb442ffb8e692a752b86af0fec0348b66554bc64e2950c9779e6a60b03123f9e8ba04d97d709ad

                                      • C:\Windows\rss\csrss.exe

                                        Filesize

                                        4.2MB

                                        MD5

                                        62dc86ed5cec63e5ccb959c407a4a591

                                        SHA1

                                        2070a84ba529d62ee28745bbc5c810bfbb9b721c

                                        SHA256

                                        71f340c235577a1f93b73d1dc4d2dde146c843510db05ae6c098380ab53bc6b1

                                        SHA512

                                        de79eeef9db2c8ffc50fc843a397f3bd48d61a52287ecc13ab32093a4405bf3c338cb87f4bf71f76c1e7e6e30dca6a4cc683657009558ff6b7ac11295884dc3c

                                      • C:\Windows\windefender.exe

                                        Filesize

                                        2.0MB

                                        MD5

                                        8e67f58837092385dcf01e8a2b4f5783

                                        SHA1

                                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                        SHA256

                                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                        SHA512

                                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                      • memory/948-29-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/948-57-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/948-4-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/948-49-0x00000000052D0000-0x0000000005BBB000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/948-3-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/948-1-0x0000000004ED0000-0x00000000052CE000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/948-2-0x00000000052D0000-0x0000000005BBB000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/948-30-0x0000000004ED0000-0x00000000052CE000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/1076-151-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1076-124-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1076-126-0x00000000054D0000-0x00000000054E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1076-125-0x00000000054D0000-0x00000000054E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1076-136-0x00000000062C0000-0x0000000006614000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/1076-138-0x00000000054D0000-0x00000000054E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1076-139-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/1076-140-0x0000000071360000-0x00000000716B4000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/1428-109-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1428-110-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/1428-106-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1428-107-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1428-111-0x0000000071380000-0x00000000716D4000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/1428-95-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1428-121-0x000000007F850000-0x000000007F860000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1428-123-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1520-60-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/1520-101-0x0000000004D70000-0x0000000005177000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/1520-93-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/1520-155-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/1520-59-0x0000000004D70000-0x0000000005177000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/3156-74-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3156-91-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3156-62-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3156-63-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3156-65-0x0000000005B00000-0x0000000005E54000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/3156-61-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3156-76-0x0000000071380000-0x00000000716D4000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/3156-75-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/3156-86-0x0000000007360000-0x0000000007403000-memory.dmp

                                        Filesize

                                        652KB

                                      • memory/3156-87-0x0000000007680000-0x0000000007691000-memory.dmp

                                        Filesize

                                        68KB

                                      • memory/3156-88-0x00000000076F0000-0x0000000007704000-memory.dmp

                                        Filesize

                                        80KB

                                      • memory/3924-274-0x0000000000400000-0x00000000008DF000-memory.dmp

                                        Filesize

                                        4.9MB

                                      • memory/3924-268-0x0000000000400000-0x00000000008DF000-memory.dmp

                                        Filesize

                                        4.9MB

                                      • memory/3944-285-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-282-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-279-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-276-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-273-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-270-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-267-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-257-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/3944-221-0x0000000000400000-0x0000000003118000-memory.dmp

                                        Filesize

                                        45.1MB

                                      • memory/4324-28-0x0000000006E80000-0x0000000006E9A000-memory.dmp

                                        Filesize

                                        104KB

                                      • memory/4324-34-0x0000000070D60000-0x00000000710B4000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/4324-31-0x0000000007040000-0x0000000007072000-memory.dmp

                                        Filesize

                                        200KB

                                      • memory/4324-32-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/4324-27-0x00000000074E0000-0x0000000007B5A000-memory.dmp

                                        Filesize

                                        6.5MB

                                      • memory/4324-26-0x0000000006DE0000-0x0000000006E56000-memory.dmp

                                        Filesize

                                        472KB

                                      • memory/4324-25-0x0000000002620000-0x0000000002630000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4324-24-0x0000000006030000-0x0000000006074000-memory.dmp

                                        Filesize

                                        272KB

                                      • memory/4324-23-0x0000000005B10000-0x0000000005B5C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/4324-22-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/4324-21-0x00000000055C0000-0x0000000005914000-memory.dmp

                                        Filesize

                                        3.3MB

                                      • memory/4324-16-0x0000000005450000-0x00000000054B6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/4324-10-0x0000000004C70000-0x0000000004CD6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/4324-9-0x0000000004AD0000-0x0000000004AF2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/4324-8-0x0000000004CF0000-0x0000000005318000-memory.dmp

                                        Filesize

                                        6.2MB

                                      • memory/4324-33-0x000000007F590000-0x000000007F5A0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4324-7-0x0000000002620000-0x0000000002630000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4324-6-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/4324-44-0x0000000007020000-0x000000000703E000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/4324-5-0x00000000024A0000-0x00000000024D6000-memory.dmp

                                        Filesize

                                        216KB

                                      • memory/4324-56-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/4324-45-0x0000000007080000-0x0000000007123000-memory.dmp

                                        Filesize

                                        652KB

                                      • memory/4324-46-0x0000000007170000-0x000000000717A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/4324-47-0x0000000007280000-0x0000000007316000-memory.dmp

                                        Filesize

                                        600KB

                                      • memory/4324-48-0x00000000071A0000-0x00000000071B1000-memory.dmp

                                        Filesize

                                        68KB

                                      • memory/4324-50-0x00000000071F0000-0x00000000071FE000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/4324-51-0x0000000007200000-0x0000000007214000-memory.dmp

                                        Filesize

                                        80KB

                                      • memory/4324-52-0x0000000007250000-0x000000000726A000-memory.dmp

                                        Filesize

                                        104KB

                                      • memory/4324-53-0x0000000007240000-0x0000000007248000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/4484-265-0x0000000000400000-0x00000000008DF000-memory.dmp

                                        Filesize

                                        4.9MB