Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 01:25

General

  • Target

    https://drive.usercontent.google.com/download?id=1pnaaZTu2NhDPR33kFEeg0iltT-wdGZJO&export=download

Malware Config

Extracted

Family

remcos

Botnet

BTC

C2

12septiembre.con-ip.com:7774

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-KZSOAU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.usercontent.google.com/download?id=1pnaaZTu2NhDPR33kFEeg0iltT-wdGZJO&export=download
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb538f46f8,0x7ffb538f4708,0x7ffb538f4718
      2⤵
        PID:1728
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        2⤵
          PID:2448
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
          2⤵
            PID:1100
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
            2⤵
              PID:4524
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
              2⤵
                PID:3884
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
                2⤵
                  PID:4408
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                  2⤵
                    PID:1688
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4040
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5576 /prefetch:8
                    2⤵
                      PID:4412
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                      2⤵
                        PID:2120
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                        2⤵
                          PID:5020
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                          2⤵
                            PID:2828
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                            2⤵
                              PID:920
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                              2⤵
                                PID:4828
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11297545589512401078,3996445323018896057,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2760
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1992
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:548
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:1004
                                  • C:\Program Files\7-Zip\7zG.exe
                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap28644:146:7zEvent19822
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1732
                                  • C:\Users\Admin\Downloads\Ofx396TutelaRadicado2024 00227 00 5118 906.exe
                                    "C:\Users\Admin\Downloads\Ofx396TutelaRadicado2024 00227 00 5118 906.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    PID:2584
                                    • C:\Users\Admin\Downloads\Ofx396TutelaRadicado2024 00227 00 5118 906.exe
                                      "C:\Users\Admin\Downloads\Ofx396TutelaRadicado2024 00227 00 5118 906.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3712

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\ProgramData\remcos\logs.dat

                                    Filesize

                                    132B

                                    MD5

                                    a40e141fa350a21e7ec19c12c1ec26a3

                                    SHA1

                                    c2e97e4dcd38bb214269418fe2cf9bb77a819315

                                    SHA256

                                    85924fc017a53d36580416ac1b681bab49738523be537da8d1a5ba8db067ff02

                                    SHA512

                                    d0f136810c97f5d90ce46b94a2fbedba7db0c416c4fff9a40e46d56a9925318e9db1ec4d3a467389de47315cb4deef5b6f1b36a01b844809844da19411f4ed9c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    ecf7ca53c80b5245e35839009d12f866

                                    SHA1

                                    a7af77cf31d410708ebd35a232a80bddfb0615bb

                                    SHA256

                                    882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                    SHA512

                                    706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    4dd2754d1bea40445984d65abee82b21

                                    SHA1

                                    4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                    SHA256

                                    183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                    SHA512

                                    92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    602B

                                    MD5

                                    cc592e70ea3b67291df8fa3da09b2e16

                                    SHA1

                                    be3db7c3749eb0f919fabf74bd741effc148a509

                                    SHA256

                                    6645d2893e5fd44ff8733228fd4c7e3875118d58765cef2c323baaf8169e2848

                                    SHA512

                                    032e16621fe3eeef6e4ea4e35623ce6d462211829298b4db44b6790bcb967923e326a8f040639f211fb6a9e08c7a5a58ab23bb802caa8c4bd7a931778091a14a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    a281625af6ee2935a5863b3fb31656a6

                                    SHA1

                                    d82e6bc69deb9ac174c55ca98a197dcdce1f1404

                                    SHA256

                                    27f712978166b6eb0437a587ce146a47bd3bc3d47a42b46e737b76e0a31332e3

                                    SHA512

                                    a354972b51cf4c4645237a1df51d51b18a7ad46d44d3d81b3480d8cc5215ea10f0b50319466ab71ef02f89da9763f334c059d6c69246d268deb7174f8e53a228

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    66fbbd01581e121fa36598da3c8ded8b

                                    SHA1

                                    6d7ecd16b688c856911abfeda9561132235f9223

                                    SHA256

                                    dc014a51cb7ddd3a9b8acfbbb489368cf5bef9022c45410d4cc0bc37873df439

                                    SHA512

                                    e4019807a8e6738e80590902ab3c2031cd8daef57b82a6130163a0c726e083c910a586b03f802010097f9f54d63ee75c5b7414b13875cd9f3b4d9d751d62211f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    365add4abd18a838d20f19ae5e03f41b

                                    SHA1

                                    85411092215ad8f0842d1115203745f21cef62e7

                                    SHA256

                                    cf4cf21ad11ae00c54571f068ee493f08b5709619e1f124fa9aab9c9c6f00125

                                    SHA512

                                    0ed73cb4fc43a20e885aa958707d3d02bfa3cc3a96614532e2ec24d9cdd896276dd7435efad84b2ccd911454043d519116c8e2994497d5d0108a3bcb41592f90

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    a332f9d8aab14abf03fa74552f15df77

                                    SHA1

                                    0e3844322ed1a3b68262bea459befc7de07d9882

                                    SHA256

                                    8df587175456a30166391d8fbf827d117541b19d61a4fe2efa6e9e50d8868b22

                                    SHA512

                                    65fcba411a3a5c29394de2d1ec1ddb572d1806a558ad0a40e3ba68dfa4c4dc7ca405c663c38915820f3b03b7b390261ef89c579b6024882e6d69c7ff286137ba

                                  • C:\Users\Admin\Downloads\Ofx396TutelaRadicado2024 00227 00 5118 906.exe

                                    Filesize

                                    1.9MB

                                    MD5

                                    ba2844f231efb9be74e8e9cf8c954bf3

                                    SHA1

                                    422f228fd0465811ad43fe8e37922030ea1d912c

                                    SHA256

                                    9fd59e24dd962c811ceb6049e7c073d39d425a759ab810eb2b156b99a9fc3b4f

                                    SHA512

                                    1dba709812fe93494df290d652e1b8b74f2588f59f230eb1bddf3eb15c5b9d8debbbc630ea3c83af5d68839d57c82e6cf5cf999a36aa5aa256b792c28029d9ae

                                  • C:\Users\Admin\Downloads\Unconfirmed 942576.crdownload

                                    Filesize

                                    910KB

                                    MD5

                                    b76b3a752eb1c8e7489680da45bdfa05

                                    SHA1

                                    66b4f692a8c24fed011fa3380563cb094d89ac4e

                                    SHA256

                                    aaec923778f92b646341699056d3d25d3213a1c7ef795b87e0906ba6523a3cf4

                                    SHA512

                                    8e1249d3e7112b9b3d4d4feabd5840987e2a51b8b6250766b273e8e28a0d66154a9a858987c3bebf67c8ed9308e88d0cdf63d6553e4956ee70832f5228cbeae4

                                  • memory/2584-96-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/2584-98-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/2584-99-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/2584-97-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/2584-104-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/2584-103-0x0000000000400000-0x00000000005E7000-memory.dmp

                                    Filesize

                                    1.9MB

                                  • memory/3712-107-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-108-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-111-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-112-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-102-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-147-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-148-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-105-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-153-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-154-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-162-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-163-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-179-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB

                                  • memory/3712-180-0x00000000005F0000-0x0000000000672000-memory.dmp

                                    Filesize

                                    520KB