Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/05/2024, 19:24

General

  • Target

    7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16.exe

  • Size

    4.1MB

  • MD5

    ac85df3b6d5030773ca94d4840c90694

  • SHA1

    991cd92e0caa33e1613995cfc7a84b5757931d61

  • SHA256

    7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16

  • SHA512

    f28e64b477b6b34f7b32955fc566460c95b23aa983b6f6bad2143945f9fc630a8a9ce1f3fa201879e63aa34c4df890e85f9dc6c11b5580f1ac7b3c14e8f22854

  • SSDEEP

    98304:npLl5dh/cY//0ytMliSDJIrO0tWgVy355J08nZmlsCU:pLlNLHtGNcOLFp5JFwlsCU

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16.exe
    "C:\Users\Admin\AppData\Local\Temp\7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Users\Admin\AppData\Local\Temp\7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16.exe
      "C:\Users\Admin\AppData\Local\Temp\7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:3900
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3396
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3780
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1616
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1488
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4092
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4076
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1148
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4792
          • C:\Windows\windefender.exe
            "C:\Windows\windefender.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4924
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3792
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3752
    • C:\Windows\windefender.exe
      C:\Windows\windefender.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4608

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gsb0aig1.fns.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d0c46cad6c0778401e21910bd6b56b70

            SHA1

            7be418951ea96326aca445b8dfe449b2bfa0dca6

            SHA256

            9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

            SHA512

            057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            46e442bab8f6ed947ea1f4a6ff27015e

            SHA1

            7b74bf208edd4ae33c1c338e1c9d95cce431b629

            SHA256

            647e2234108ce0bf1a929373c51dd4815f549790ef95f8d816f6c211d4d82f14

            SHA512

            56d868503d255d65fb2268d4d244d1294c618c34656fc1875d3355a1f1582f8b7ef95551797ac2195f1bdbe812d911d21f77ad4dd7f5f25e01aea3ec69dbc90d

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            2728551b73e136fd4862c73317bc85f7

            SHA1

            0577fb167e2e9b9528578a4e237ced09b9c76e38

            SHA256

            70b6483f013ab266d667f5f74d05b3e29731c5f2f94414bbd4eabf44d4d706f1

            SHA512

            cb427fafb07a9ad93ddb6276024c07bbc8bc3c0a373b4dc91ec15ebbd7fad3eb1fec5d96e824350d0be1890a4f7c23466c19500692aaf069ccd2a88e3080fca4

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            d0eb38348a3a249f8fac202dc9982293

            SHA1

            73869be730e92383b6b5e73ccf05dda994a7613e

            SHA256

            f18d9a1abd41173931920ab7f71341f36fd9be06b6a11e6a4b04ded0568f757d

            SHA512

            2773c8fd49a5f35fddb1318fa9a2859ccc5cc0d450464044b429e95166ee7cf9c09c1d4112564e799d1d02d8d9bb867a7b8ab23c1104496ee470f0fee98afd78

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            ecab2445338225a1fa6942a5add92f99

            SHA1

            a3386b9eeaeb50d0ddd8da1d24199869b4785e9f

            SHA256

            81c82be24c196eb4a4e4299229be7c44dace4ad03be5715e53b9ac19c07c8f8f

            SHA512

            4acf46d1969642154e39b40dc83fec23a9eb26ec50126fbfd65d52d64611da4208b47384d261fb2673c7a26439903a3d4c4422a9b12eacfc8ac4c1d579f2d09f

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

            Filesize

            19KB

            MD5

            b471ed135dfacda3b201c1e8b149a81e

            SHA1

            eaf7c15296ed4259dae6e252be7dfe765ba41248

            SHA256

            75e5c7ad28fe626cb805fedfdcae9225d7701ec1c75311ed5c518b27bdb39934

            SHA512

            c9c35849f620522c53be90b6ee0be39205d498f749a061e52fb9250ba12161e79672b47ba6ccd18779ed374ad3c782626c8a441fbe04643b547227550cee9191

          • C:\Windows\rss\csrss.exe

            Filesize

            4.1MB

            MD5

            ac85df3b6d5030773ca94d4840c90694

            SHA1

            991cd92e0caa33e1613995cfc7a84b5757931d61

            SHA256

            7dfc75f8caeb94eddd86145e84353600a18bf1e3c9075b79487e556d53584f16

            SHA512

            f28e64b477b6b34f7b32955fc566460c95b23aa983b6f6bad2143945f9fc630a8a9ce1f3fa201879e63aa34c4df890e85f9dc6c11b5580f1ac7b3c14e8f22854

          • C:\Windows\windefender.exe

            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

          • memory/1316-34-0x00000000071D0000-0x00000000071EE000-memory.dmp

            Filesize

            120KB

          • memory/1316-39-0x0000000007460000-0x00000000074F6000-memory.dmp

            Filesize

            600KB

          • memory/1316-20-0x0000000005D80000-0x0000000005D9E000-memory.dmp

            Filesize

            120KB

          • memory/1316-21-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

            Filesize

            304KB

          • memory/1316-22-0x0000000006320000-0x0000000006366000-memory.dmp

            Filesize

            280KB

          • memory/1316-23-0x0000000007190000-0x00000000071C4000-memory.dmp

            Filesize

            208KB

          • memory/1316-24-0x00000000705D0000-0x000000007061C000-memory.dmp

            Filesize

            304KB

          • memory/1316-25-0x00000000707E0000-0x0000000070B37000-memory.dmp

            Filesize

            3.3MB

          • memory/1316-9-0x0000000005050000-0x00000000050B6000-memory.dmp

            Filesize

            408KB

          • memory/1316-35-0x00000000071F0000-0x0000000007294000-memory.dmp

            Filesize

            656KB

          • memory/1316-37-0x0000000007310000-0x000000000732A000-memory.dmp

            Filesize

            104KB

          • memory/1316-36-0x0000000007950000-0x0000000007FCA000-memory.dmp

            Filesize

            6.5MB

          • memory/1316-38-0x0000000007350000-0x000000000735A000-memory.dmp

            Filesize

            40KB

          • memory/1316-19-0x00000000058C0000-0x0000000005C17000-memory.dmp

            Filesize

            3.3MB

          • memory/1316-40-0x0000000007370000-0x0000000007381000-memory.dmp

            Filesize

            68KB

          • memory/1316-41-0x00000000073C0000-0x00000000073CE000-memory.dmp

            Filesize

            56KB

          • memory/1316-42-0x00000000073D0000-0x00000000073E5000-memory.dmp

            Filesize

            84KB

          • memory/1316-43-0x0000000007420000-0x000000000743A000-memory.dmp

            Filesize

            104KB

          • memory/1316-44-0x0000000007440000-0x0000000007448000-memory.dmp

            Filesize

            32KB

          • memory/1316-47-0x0000000074360000-0x0000000074B11000-memory.dmp

            Filesize

            7.7MB

          • memory/1316-10-0x00000000050C0000-0x0000000005126000-memory.dmp

            Filesize

            408KB

          • memory/1316-8-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

            Filesize

            136KB

          • memory/1316-7-0x0000000005190000-0x00000000057BA000-memory.dmp

            Filesize

            6.2MB

          • memory/1316-6-0x0000000074360000-0x0000000074B11000-memory.dmp

            Filesize

            7.7MB

          • memory/1316-5-0x00000000028C0000-0x00000000028F6000-memory.dmp

            Filesize

            216KB

          • memory/1316-4-0x000000007436E000-0x000000007436F000-memory.dmp

            Filesize

            4KB

          • memory/1440-86-0x0000000005900000-0x0000000005C57000-memory.dmp

            Filesize

            3.3MB

          • memory/1440-88-0x00000000705D0000-0x000000007061C000-memory.dmp

            Filesize

            304KB

          • memory/1440-89-0x0000000070770000-0x0000000070AC7000-memory.dmp

            Filesize

            3.3MB

          • memory/1940-61-0x00000000705D0000-0x000000007061C000-memory.dmp

            Filesize

            304KB

          • memory/1940-73-0x0000000007140000-0x0000000007151000-memory.dmp

            Filesize

            68KB

          • memory/1940-74-0x0000000007190000-0x00000000071A5000-memory.dmp

            Filesize

            84KB

          • memory/1940-71-0x0000000006E10000-0x0000000006EB4000-memory.dmp

            Filesize

            656KB

          • memory/1940-60-0x0000000005840000-0x0000000005B97000-memory.dmp

            Filesize

            3.3MB

          • memory/1940-62-0x0000000070750000-0x0000000070AA7000-memory.dmp

            Filesize

            3.3MB

          • memory/2616-99-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/2616-2-0x0000000005000000-0x00000000058EB000-memory.dmp

            Filesize

            8.9MB

          • memory/2616-50-0x0000000003260000-0x000000000365A000-memory.dmp

            Filesize

            4.0MB

          • memory/2616-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

          • memory/2616-48-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2616-1-0x0000000003260000-0x000000000365A000-memory.dmp

            Filesize

            4.0MB

          • memory/2616-72-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2616-51-0x0000000005000000-0x00000000058EB000-memory.dmp

            Filesize

            8.9MB

          • memory/2860-226-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-222-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-238-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-151-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-246-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-235-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-242-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-230-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-214-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-203-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/2860-219-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/3396-111-0x0000000070750000-0x0000000070AA7000-memory.dmp

            Filesize

            3.3MB

          • memory/3396-110-0x00000000705D0000-0x000000007061C000-memory.dmp

            Filesize

            304KB

          • memory/3780-139-0x00000000705D0000-0x000000007061C000-memory.dmp

            Filesize

            304KB

          • memory/3780-140-0x0000000070750000-0x0000000070AA7000-memory.dmp

            Filesize

            3.3MB

          • memory/4076-186-0x00000000704F0000-0x000000007053C000-memory.dmp

            Filesize

            304KB

          • memory/4076-187-0x0000000070740000-0x0000000070A97000-memory.dmp

            Filesize

            3.3MB

          • memory/4092-162-0x00000000704F0000-0x000000007053C000-memory.dmp

            Filesize

            304KB

          • memory/4092-174-0x00000000065D0000-0x00000000065E5000-memory.dmp

            Filesize

            84KB

          • memory/4092-173-0x0000000007DA0000-0x0000000007DB1000-memory.dmp

            Filesize

            68KB

          • memory/4092-163-0x0000000070740000-0x0000000070A97000-memory.dmp

            Filesize

            3.3MB

          • memory/4092-172-0x00000000079F0000-0x0000000007A94000-memory.dmp

            Filesize

            656KB

          • memory/4092-161-0x00000000067F0000-0x000000000683C000-memory.dmp

            Filesize

            304KB

          • memory/4092-150-0x0000000006250000-0x00000000065A7000-memory.dmp

            Filesize

            3.3MB

          • memory/4376-127-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/4376-98-0x0000000000400000-0x0000000002EDD000-memory.dmp

            Filesize

            42.9MB

          • memory/4608-217-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4608-225-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4924-213-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

          • memory/4924-209-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB