Overview

overview

8

Static

static

3

glowogfn.exe

windows10-2004-x64

8

glowogfn.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    44s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/06/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    glowogfn.exe
  • Size 24.6MB
  • Sample260627-cbm9msg14q
  • SHA256 86c145effe236d212d85b3fc269aead4678148612f84bdea64e7da7e12843b73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasionexecutionpersistence

Malware Config

Signatures

  • Drops file in Drivers directory 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 32 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 4 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 8 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Modifies boot configuration data using bcdedit 16 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\glowogfn.exe
    "C:\Users\Admin\AppData\Local\Temp\glowogfn.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
      2⤵
      • Indicator Removal: Clear Persistence
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\schtasks.exe
        schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
        3⤵
          PID:3928
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
        2⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
          3⤵
            PID:4868
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3444
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4232
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {bootmgr} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:5080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {default} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:2608
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {memdiag} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:1028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {current} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:3716
      • C:\Windows\System32\drivers\Pyrite.dat
        C:\Windows\System32\drivers\Pyrite.dat
        1⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
          2⤵
          • Indicator Removal: Clear Persistence
          • Suspicious use of WriteProcessMemory
          PID:1084
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
            3⤵
              PID:5036
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2468
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4860
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
            2⤵
            • Indicator Removal: Clear Persistence
            • Suspicious use of WriteProcessMemory
            PID:4964
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
              3⤵
                PID:3292
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3308
              • C:\Windows\system32\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1032
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3848
              • C:\Windows\system32\bcdedit.exe
                bcdedit /deletevalue {bootmgr} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:1752
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\system32\bcdedit.exe
                bcdedit /deletevalue {default} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:1516
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4860
              • C:\Windows\system32\bcdedit.exe
                bcdedit /deletevalue {memdiag} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4932
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Windows\system32\bcdedit.exe
                bcdedit /deletevalue {current} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4224
          • C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
            C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
            1⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Writes to the Master Boot Record (MBR)
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2076
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
              2⤵
              • Indicator Removal: Clear Persistence
              • Suspicious use of WriteProcessMemory
              PID:3932
              • C:\Windows\system32\schtasks.exe
                schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                3⤵
                  PID:4388
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2668
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2088
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                2⤵
                • Indicator Removal: Clear Persistence
                • Suspicious use of WriteProcessMemory
                PID:4492
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                  3⤵
                    PID:3844
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2368
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:912
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4552
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /deletevalue {bootmgr} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:4496
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4344
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /deletevalue {default} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:5064
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2168
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /deletevalue {memdiag} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:636
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4032
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /deletevalue {current} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:724
              • C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                1⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1348
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                  2⤵
                  • Indicator Removal: Clear Persistence
                  • Suspicious use of WriteProcessMemory
                  PID:3172
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                    3⤵
                      PID:2652
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3152
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1356
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                    2⤵
                    • Indicator Removal: Clear Persistence
                    • Suspicious use of WriteProcessMemory
                    PID:4028
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                      3⤵
                        PID:4196
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3632
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:4140
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:804
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /deletevalue {bootmgr} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:3256
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2532
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /deletevalue {default} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:4144
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:628
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /deletevalue {memdiag} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:4808
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1724
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /deletevalue {current} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1668
                  • C:\$Recycle.Bin\System Volume Information\winlogon.exe
                    "C:\$Recycle.Bin\System Volume Information\winlogon.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1520
                  • C:\Windows\system32\werfault.exe
                    werfault.exe /hc /shared Global\26aeabd972ad413ba655a177fb585ecf /t 3872 /p 3828
                    1⤵
                      PID:2276
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4740
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:2608
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4496

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                winlogon.exe
                                • Path C:\$Recycle.Bin\System Volume Information\winlogon.exe
                                • Size 24.6MB
                                • SHA256 86c145effe236d212d85b3fc269aead4678148612f84bdea64e7da7e12843b73
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/772-0-0x000000014000A000-0x0000000140EE5000-memory.dmp
                                Download

                                memory/772-1-0x00007FFBFFB70000-0x00007FFBFFB72000-memory.dmp
                                Download

                                memory/772-2-0x00007FFBFFB80000-0x00007FFBFFB82000-memory.dmp
                                Download

                                memory/772-3-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/772-4-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/772-5-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/772-31-0x000000014000A000-0x0000000140EE5000-memory.dmp
                                Download

                                memory/1348-30-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/1520-34-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/2076-27-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download

                                memory/4544-22-0x0000000140000000-0x000000014278B000-memory.dmp
                                Download